CVE-2026-3893:

CVE-2026-3893 is a missing authentication vulnerability (CWE-306) in the Carlson VASCO-B GNSS Receiver that allows unauthenticated network attackers to access and modify device configuration and operational functions.

Score
A numerical rating that indicates how dangerous this vulnerability is.

9.4Critical

Published Date:Apr 28, 2026
CISA KEV Date:*No Data*
Industries Affected:20

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.5
Confidentiality Impact:LOW
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Overview

CVE-2026-3893 affects the Carlson VASCO-B GNSS Receiver, an OT/industrial device used for GNSS-based positioning. The device lacks any authentication mechanism on its network interface, classified under CWE-306 (Missing Authentication for Critical Function). This critical-severity vulnerability (CVSS 9.4) can be exploited remotely by any unauthenticated attacker with network access, requiring no special privileges or user interaction. Exploitation enables direct access to device configuration and operational controls, posing a serious risk to the integrity and availability of the affected receiver and any dependent systems.

Remediation

Users and administrators of the Carlson VASCO-B GNSS Receiver should take the following steps to mitigate exposure to CVE-2026-3893:
Contact Carlson Software support via [https://www.carlsonsw.com/support-and-training/](https://www.carlsonsw.com/support-and-training/) for firmware updates or patches that introduce authentication controls.
Isolate the VASCO-B GNSS Receiver from untrusted networks by placing it behind a firewall or within a dedicated network segment with strict access controls.
Implement network-level access controls such as VPNs or allowlists to restrict which hosts can communicate with the device.
Monitor network traffic to and from the device for unauthorized access attempts.
Follow ICS/OT security best practices by minimizing the device's network exposure until a vendor-provided fix is applied.