PT-2026-34742 · Carlson · Vasco-B Gnss Receiver

Souvik Kandar · Published 2026-04-23 · Updated 2026-04-28 · CVE-2026-3893

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions Carlson VASCO-B GNSS Receiver (affected versions not specified)

Description The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism. This allows an attacker with network access to directly access and modify its configuration and operational functions without credentials. There have been reports of attackers exploiting this flaw to gain unauthenticated access, escalate privileges, and move laterally through manufacturing networks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Implement runtime segmentation to contain post-compromise activity in critical infrastructure.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-3893

Affected Products

Vasco-B Gnss Receiver

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-3893 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-3893 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-02.json · Note
• https://twitter.com/windowsforum/status/2047362457769742391 · Twitter Post
• https://twitter.com/aviatrixtrc/status/2048077924243292553 · Twitter Post
• https://carlsonsw.com/support-and-training · Note
• https://twitter.com/CVEnew/status/2049227557489275230 · Twitter Post