GPL Odorizers GPL750 Fehlende Authentifizierung für kritische Funktion

The impact of CVE-2026-4436 is severe due to the potential for gas leaks and explosions. By manipulating the odorant injection logic, an attacker could effectively mask a gas leak, preventing residents from detecting it through smell. This could lead to a dangerous buildup of gas, increasing the risk of ignition and subsequent explosion. The attack surface is the Modbus interface, which is commonly used for industrial control systems. Successful exploitation requires network access to the GPL750 (XL4) device, but does not require authentication. This makes it a particularly concerning vulnerability, as it could be exploited remotely without needing credentials.

Critical infrastructure operators, particularly those utilizing GPL Odorizers GPL750 (XL4) for natural gas odorization, are at significant risk. This includes gas distribution companies, pipeline operators, and industrial facilities that rely on natural gas. Legacy installations and systems with inadequate network segmentation are particularly vulnerable.

• linux / server:

journalctl -u gpl750 -f | grep -i modbus

• linux / server:

ps aux | grep -i modbus

• generic web: Use a network analyzer (e.g., Wireshark) to monitor Modbus traffic on the device's network interface for suspicious activity or unexpected register value changes.

1. 2026-04-09Disclosure

   disclosure

1. Reserviert2026-03-19
2. Veröffentlicht2026-04-09
3. Geändert2026-04-14
4. EPSS aktualisiert2026-04-17

The primary mitigation for CVE-2026-4436 is to upgrade the GPL Odorizers GPL750 (XL4) to version v20.0 or later, which contains the fix. If an immediate upgrade is not possible, consider segmenting the network to restrict access to the Modbus interface. Implement strict firewall rules to limit inbound connections to the device, allowing only authorized traffic. Monitoring Modbus traffic for unusual patterns or unexpected register value changes can also provide early detection of potential exploitation attempts. After upgrading, verify the fix by attempting to send a Modbus packet designed to manipulate the odorant injection register and confirming that the injection logic remains unaffected.