CVE-2026-4436 GPL Odorizers CVE debrief

Who should care

Operators and maintainers of GPL750-based odorization systems, OT/ICS security teams, control engineers, and network defenders responsible for environments where Modbus is reachable from untrusted or broadly shared networks.

Technical summary

According to the CISA CSAF advisory, the issue affects GPL750 (XL4) >=v1.0 and <v6.0, GPL750 (XL4 Prime) >=v4.0 and <v6.0, GPL750 (XL7) >=v13.0 and <v20.0, and GPL750 (XL7 Prime) >=v18.4 and <v20.0. A remote attacker with low privileges can send Modbus packets to manipulate register values that feed the odorant injection logic, which can cause over-injection or under-injection into a gas line. The supplied CVSS vector indicates network attackability and integrity impact, with no confidentiality impact reported.

Defensive priority

Immediate

Recommended defensive actions

• Update the GPL750 software and the corresponding Horner Automation firmware to the latest vendor-supported versions for the affected XL4, XL4 Prime, XL7, and XL7 Prime devices.
• Follow the vendor’s microSD update guidance carefully, including removing old files as instructed and preserving only the files required by the advisory for your configuration.
• Restrict Modbus access to trusted engineering hosts and networks, and apply CISA ICS recommended practices and defense-in-depth guidance to reduce exposure.
• Review OT network activity for unauthorized Modbus connections or unexpected register-write activity affecting odorant injection settings.
• If you need assistance with the update process, coordinate with GPL Odorizers and use the official installation guidance referenced in the advisory.

Evidence notes

This debrief is based on the CISA CSAF advisory for ICSA-26-099-02 / CVE-2026-4436, published 2026-04-09. The advisory states that low-privileged remote Modbus traffic can alter register values used by odorant injection logic, lists the affected GPL750 version ranges, and provides remediation guidance to update software/firmware and follow the vendor’s installation instructions. No exploit code or unverified impact claims were used.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.