CVE-2026-3893
Published: 28 April 2026
Summary
CVE-2026-3893 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Carlsonsw (inferred from references). Its CVSS base score is 9.4 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-17 (Remote Access) and SC-7 (Boundary Protection).
Deeper analysis
CVE-2026-3893 is a missing authentication vulnerability (CWE-306) in the Carlson VASCO-B GNSS Receiver. The device lacks any authentication mechanism, enabling unauthorized access to its configuration and operational functions over the network without credentials. Published on 2026-04-28, it carries a CVSS v3.1 base score of 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H), indicating critical severity due to high impacts on integrity and availability.
Attackers with network access to the receiver can exploit this vulnerability with low complexity, no privileges, and no user interaction required. Exploitation allows direct modification of the device's configuration and operational functions, potentially disrupting GNSS operations, altering positioning data integrity, or enabling denial-of-service conditions, while exposing limited confidential information.
Advisories reference ICSA-26-113-02 in the CISA CSAF repository (https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-02.json), Carlson Software's support and training page (https://www.carlsonsw.com/support-and-training/), and the official CVE record (https://www.cve.org/CVERecord?id=CVE-2026-3893) for mitigation guidance, including potential network segmentation or firmware updates where available.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26081
Vulnerability details
The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing an attacker with network access to directly access and modify its configuration and operational functions without needing credentials.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The missing authentication vulnerability enables direct unauthorized network access to configuration and operational functions on the exposed GNSS receiver device, directly mapping to exploitation of a public-facing application without credentials or user interaction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 directly mitigates the CVE by requiring timely identification, reporting, and correction of the missing authentication flaw via firmware updates.
SC-7 prevents exploitation by monitoring and controlling network communications at boundaries, enabling segmentation to block unauthorized access to the GNSS receiver.
AC-17 requires establishing, authorizing, and monitoring remote access with authentication, directly countering unauthenticated network access to configuration functions.