Cyber Resilience

CVE-2026-3893

CriticalUpdated

Published: 28 April 2026

Published
28 April 2026
Modified
16 June 2026
KEV Added
Patch
CVSS Score v3.1 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
EPSS Score 0.0037 29.3th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-3893 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Carlsonsw (inferred from references). Its CVSS base score is 9.4 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-17 (Remote Access) and SC-7 (Boundary Protection).

Deeper analysis

CVE-2026-3893 is a missing authentication vulnerability (CWE-306) in the Carlson VASCO-B GNSS Receiver. The device lacks any authentication mechanism, enabling unauthorized access to its configuration and operational functions over the network without credentials. Published on 2026-04-28, it carries a CVSS v3.1 base score of 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H), indicating critical severity due to high impacts on integrity and availability.

Attackers with network access to the receiver can exploit this vulnerability with low complexity, no privileges, and no user interaction required. Exploitation allows direct modification of the device's configuration and operational functions, potentially disrupting GNSS operations, altering positioning data integrity, or enabling denial-of-service conditions, while exposing limited confidential information.

Advisories reference ICSA-26-113-02 in the CISA CSAF repository (https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-02.json), Carlson Software's support and training page (https://www.carlsonsw.com/support-and-training/), and the official CVE record (https://www.cve.org/CVERecord?id=CVE-2026-3893) for mitigation guidance, including potential network segmentation or firmware updates where available.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing an attacker with network access to directly access and modify its configuration and operational functions without needing credentials.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The missing authentication vulnerability enables direct unauthorized network access to configuration and operational functions on the exposed GNSS receiver device, directly mapping to exploitation of a public-facing application without credentials or user interaction.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-4810Shared CWE-306
CVE-2025-53847Shared CWE-306
CVE-2025-61757Shared CWE-306
CVE-2025-68715Shared CWE-306
CVE-2026-21992Shared CWE-306
CVE-2025-26362Shared CWE-306
CVE-2026-48692Shared CWE-306
CVE-2022-50981Shared CWE-306
CVE-2025-58083Shared CWE-306
CVE-2025-21515Shared CWE-306

Affected Assets

Carlsonsw
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

SI-2 directly mitigates the CVE by requiring timely identification, reporting, and correction of the missing authentication flaw via firmware updates.

preventdetect

SC-7 prevents exploitation by monitoring and controlling network communications at boundaries, enabling segmentation to block unauthorized access to the GNSS receiver.

preventdetect

AC-17 requires establishing, authorizing, and monitoring remote access with authentication, directly countering unauthenticated network access to configuration functions.

References