CVE-2026-3893
published 2026-04-28CVE-2026-3893: The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing an attacker with network access to directly access and modify its configuration…
PriorityP264critical9.4CVSS 3.1
AVNACLPRNUINSUCLIHAH
EPSS
0.37%
29.2th percentile
The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism,
allowing an attacker with network access to directly access and modify
its configuration and operational functions without needing credentials.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| carlson_software | vasco-b_gnss_receiver | < 1.4.0 | 1.4.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Carlson VASCO-B GNSS Receiver up to 1.3.x missing authentication
vuldb·2026-04-28·CVSS 9.4
CVE-2026-3893 [CRITICAL] Carlson VASCO-B GNSS Receiver up to 1.3.x missing authentication
A vulnerability categorized as critical has been discovered in Carlson VASCO-B GNSS Receiver up to 1.3.x. The impacted element is an unknown function. Executing a manipulation can lead to missing authentication.
The identification of this vulnerability is CVE-2026-3893. The attack may be launched remotely. There is no exploit available.
It is advisable to upgrade the affected component.
GHSA
GHSA-fc84-9gcf-p72v: The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism,
allowing an attacker with network access to directly access and modify
its config
ghsa_unreviewed·2026-04-28
CVE-2026-3893 [CRITICAL] CWE-306 GHSA-fc84-9gcf-p72v: The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism,
allowing an attacker with network access to directly access and modify
its config
The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism,
allowing an attacker with network access to directly access and modify
its configuration and operational functions without needing credentials.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-28
Published