What is the CVSS score of CVE-2026-4436?

CVE-2026-4436 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Gpl750 Xl4 are affected by CVE-2026-4436?

CVE-2026-4436 affects GPL Odorizers industrial control systems used in natural gas distribution, allowing unauthenticated network attackers to manipulate odorant injection volumes through an…

How to fix or mitigate CVE-2026-4436?

Within 24 hours: Inventory all GPL Odorizers GPL750 devices (XL4, XL4 Prime, XL7, XL7 Prime) and document network connectivity; notify plant operations and safety teams of the vulnerability. Within 7 days: Implement network segmentation to isolate Modbus interfaces from untrusted networks; enable access control lists restricting Modbus port access to authorized engineering workstations only; deploy network monitoring on Modbus traffic for anomalous register write attempts. Within 30 days: Contact GPL Odorizers for patch availability and timeline; evaluate temporary operational workarounds with engineering and safety review; document compensating controls in your risk register pending vendor patch release.

Gpl750 Xl4 CVE-2026-4436

EUVD-2026-21066 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-04-09 icscert

GHSA-frgm-v97w-x7w6

Authentication Bypass Gpl750 Xl4 Gpl750 Xl4 Prime Gpl Odorizers Gpl750 Xl7 Gpl Odorizers Gpl750 Xl7 Prime

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 09, 2026 - 20:15 euvd

EUVD-2026-21066

Analysis Generated

Apr 09, 2026 - 20:15 vuln.today

CVE Published

Apr 09, 2026 - 20:04 nvd

HIGH 8.6

DescriptionCVE.org

A low-privileged remote attacker can send Modbus packets to manipulate register values that are inputs to the odorant injection logic such that too much or too little odorant is injected into a gas line.

AnalysisAI

Unauthenticated remote attackers can manipulate Modbus register inputs in GPL Odorizers GPL750 industrial control systems (XL4, XL4 Prime, XL7, XL7 Prime variants across versions 1.0-20.0), causing incorrect odorant injection volumes into natural gas distribution pipelines. Authentication bypass (CWE-306) via network-accessible Modbus interface permits direct register value tampering without credential validation, enabling safety-critical process manipulation. No public exploit identified at time of analysis.

Technical ContextAI

Missing authentication on Modbus TCP/IP protocol implementation allows unrestricted register write operations. CVSS vector confirms network attack vector with no authentication requirement (PR:N). CWE-306 authentication bypass permits direct manipulation of PLC registers controlling odorant injection pump rates and volume calculations in industrial gas odorization equipment.

RemediationAI

Vendor-released patch: upgrade GPL750 (XL4) and (XL4 Prime) to v6.0 or later; upgrade GPL750 (XL7) and (XL7 Prime) to v20.0 or later per CISA advisory. Until patching, implement network segmentation isolating Modbus interfaces from untrusted networks, deploy industrial firewalls with strict IP whitelisting for PLC access, and enable authentication mechanisms on upstream SCADA/HMI systems. Monitor Modbus traffic for unexpected register write operations to addresses controlling odorant injection parameters. Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-26-099-02