Vulnerability · Published Apr 9, 2026 · Assigned by icscert
CVE-2026-4436GPL Odorizers GPL750 Missing Authentication for Critical Function
High 8.6
In plain English
A high-severity missing authentication in GPL Odorizers GPL750 (XL7) from GPL Odorizers. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 3.1)8.6High
Exploit odds (30 days)0.5%top 60.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A low-privileged remote attacker can send Modbus packets to manipulate register values that are inputs to the odorant injection logic such that too much or too little odorant is injected into a gas line.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| GPL Odorizers | GPL750 (XL4) | v1.0 – before v6.0 |
| GPL Odorizers | GPL750 (XL4 Prime) | v4.0 – before v6.0 |
| GPL Odorizers | GPL Odorizers GPL750 (XL7) | v13.0 – before v20.0 |
| GPL Odorizers | GPL Odorizers GPL750 (XL7 Prime) | v18.4 – before v20.0 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N