CVE-2026-4436

{
  "id": "CVE-2026-4436",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-09T20:16:27.903",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A low-privileged remote attacker can send Modbus packets to manipulate \nregister values that are inputs to the odorant injection logic such that\n too much or too little odorant is injected into a gas line."
    },
    {
      "lang": "es",
      "value": "Un atacante remoto con pocos privilegios puede enviar paquetes Modbus para manipular los valores de los registros que son entradas para la lógica de inyección de odorante, de tal manera que se inyecte demasiado o muy poco odorante en una línea de gas."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "GPL Odorizers",
          "product": "GPL750 (XL4)",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "v1.0",
              "lessThan": "v6.0",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "GPL Odorizers",
          "product": "GPL750 (XL4 Prime)",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "v4.0",
              "lessThan": "v6.0",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "GPL Odorizers",
          "product": "GPL Odorizers GPL750 (XL7)",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "v13.0",
              "lessThan": "v20.0",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "GPL Odorizers",
          "product": "GPL Odorizers GPL750 (XL7 Prime)",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "v18.4",
              "lessThan": "v20.0",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-14T14:03:00.899159Z",
          "id": "CVE-2026-4436",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-099-02.json",
      "source": "[email protected]"
    },
    {
      "url": "https://lincenergysystems-my.sharepoint.com/:f:/p/h_baer/IgDYaHIhXpyLQJvnKPd6b80TAUgV7Lp8qmVYBFUb0lmr7ak?e=JLeADm",
      "source": "[email protected]"
    },
    {
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-099-02",
      "source": "[email protected]"
    }
  ]
}