CVE-2026-3893CWE-306

Carlson Software VASCO-B GNSS Receiver Missing Authentication for Critical Function

Critical · published April 28, 2026

CVSS v3.1
9.4
EPSS
1%
Percentile
50.8
In the wild
Unconfirmed
What it is

The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism,

allowing an attacker with network access to directly access and modify

its configuration and operational functions without needing credentials.

The record
Technical detail
CVSS v3.1
9.4 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00657 · 50.8th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-04-28T17:34Z
EPSS history
Timeline
  • 28 APR 17:34Z
    Carlson Software VASCO-B GNSS Receiver Missing Authentication for Critical Function
    cvelistv5