What’s Vulnerable › Vulnerabilities

CVE-2026-4436: GPL Odorizers GPL750 Missing Authentication for Critical Function

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-09 · updated 2026-10-26
• Weakness: CWE-306

Description

A low-privileged remote attacker can send Modbus packets to manipulate register values that are inputs to the odorant injection logic such that too much or too little odorant is injected into a gas line.

Affected products

• GPL Odorizers GPL750 (XL4): from v1.0 before v6.0 — fixed in v6.0
• GPL Odorizers GPL750 (XL4 Prime): from v4.0 before v6.0 — fixed in v6.0
• GPL Odorizers GPL750 (XL7): from v13.0 before v20.0 — fixed in v20.0
• GPL Odorizers GPL750 (XL7 Prime): from v18.4 before v20.0 — fixed in v20.0

How to fix

Upgrade to a fixed version: GPL Odorizers GPL750 (XL4) v6.0; GPL Odorizers GPL750 (XL4 Prime) v6.0; GPL Odorizers GPL750 (XL7) v20.0; GPL Odorizers GPL750 (XL7 Prime) v20.0. Check the vendor advisory for mitigations.

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-099-02.json
• https://lincenergysystems-my.sharepoint.com/:f:/p/h_baer/IgDYaHIhXpyLQJvnKPd6b80TAUgV7Lp8qmVYBFUb0lmr7ak?e=JLeADm
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-099-02

Get alerted when CVE-2026-4436 or the next vulnerability affects your stack