CVE Intelligence
Analysis AI-assisted

CVE-2026-3893: Carlson VASCO-B GNSS Receiver Missing Authentication

CVE-2026-3893 describes the Carlson VASCO-B GNSS Receiver as lacking an authentication mechanism, so a network-accessible attacker could reach configuration and operational functions without credentials. ICS-CERT assigned a CVSS 3.1 base score of 9.4 (critical), and the record maps the weakness to CWE-306. The sources consulted show no confirmed exploitation, and the record lists no affected or fixed versions.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record for CVE-2026-3893 states that the Carlson VASCO-B GNSS Receiver lacks an authentication mechanism. According to the record, an attacker with network access could reach configuration and operational functions without credentials. The CNA is ICS-CERT and the record was published on 2026-04-28.

Impact

  • The record maps the weakness to CWE-306, Missing Authentication for Critical Function.
  • The CVSS 3.1 base score of 9.4 is attributed to ics-cert@hq.dhs.gov. Its vector describes network attack vector, low complexity, no privileges required, no user interaction, low confidentiality impact, and high integrity and availability impact.
  • Since configuration and operational functions are described as reachable without credentials, the main concern is unauthorized changes to the device and disruption of its operation.

Affected products and versions

  • The product named in the record is the Carlson VASCO-B GNSS Receiver.
  • The record's affected product list is empty, so the affected versions are unknown from the available data.
  • No fixed version is listed. This does not mean no fix exists; check the vendor support page and the referenced CSAF advisory.

Exploitation status

  • The record does not list this CVE in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted.
  • The record reports an EPSS probability of 0.00657 and a percentile of 0.50122.

Remediation and mitigation

  • Inventory all Carlson VASCO-B GNSS Receiver deployments, including their firmware or software levels.
  • Do not expose receiver management or operational interfaces to untrusted networks. Restrict access to a small set of authorized systems.
  • Place receivers behind controlled network boundaries and segment them from general IT traffic.
  • Consult the Carlson support page and the CSAF advisory for vendor guidance and any updates.

Detection guidance

  • Review device and network logs for configuration changes that were not authorized.
  • Watch for connections to receiver interfaces from hosts outside approved management systems.
  • Compare current receiver configurations against known-good baselines to identify unexpected modifications.

Limitations of the available information

  • The record's source status is Deferred, and it lists no affected or fixed versions.
  • The record does not describe the protocols, default settings or firmware branches involved.
  • The CSAF advisory is cited in the record, but its contents are not reproduced in the record text, so this analysis does not rely on them.

Frequently asked questions

What is the weakness in CVE-2026-3893?

The record describes the Carlson VASCO-B GNSS Receiver as lacking an authentication mechanism, mapped to CWE-306, Missing Authentication for Critical Function.

Which versions are affected?

The record does not list affected versions, so the exact affected versions are unknown from the available data.

Is this CVE known to be exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.