Riskcovery

CVE-2026-4436

GPL Odorizers GPL750 Missing Authentication for Critical Function

State
Published
Severity
8.6 High
Published
Apr 9, 2026
Updated
Apr 14, 2026
Reserved
Mar 19, 2026

Read the record on cve.org

Description

A low-privileged remote attacker can send Modbus packets to manipulate register values that are inputs to the odorant injection logic such that too much or too little odorant is injected into a gas line.

Scores

CVSSScoreVectorSource
3.18.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:Nicscert

Weaknesses

Affected Products

ProductVersions
GPL750 (XL4)GPL Odorizers
  • v1.0 to before v6.0Affected
GPL750 (XL4 Prime)GPL Odorizers
  • v4.0 to before v6.0Affected
GPL Odorizers GPL750 (XL7)GPL Odorizers
  • v13.0 to before v20.0Affected
GPL Odorizers GPL750 (XL7 Prime)GPL Odorizers
  • v18.4 to before v20.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.