Carlson VASCO-B GNSS Receivers Left Open to Remote Hijack

In an era where precision timing and positioning are the invisible pillars of our global infrastructure, a critical has emerged that could leave essential systems drifting. A security flaw has been identified in the Carlson Software VASCO-B GNSS Receiver, a specialized device used for high-accuracy satellite navigation. The vulnerability, tracked as CVE-2026-3893, carries a severe CVSS score of 9.4, signaling a significant risk to the integrity of location-based services.

The core of the issue is a fundamental security oversight: a complete lack of an authentication mechanism.

Global Navigation Satellite System (GNSS) receivers like the VASCO-B are often “silent sentinels,” working in the background to provide the precise data required for everything from autonomous machinery to synchronized telecommunications networks. However, this newly discovered means that the sentinel isn’t just silent—it’s essentially unguarded.

Because the device lacks a requirement for credentials, any attacker who manages to gain access to the same network as the receiver can bypass security entirely.

Once an attacker has a foothold, they aren’t limited to just observing data. According to the vulnerability advisory, “The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing an attacker with network access to directly access and modify its configuration and operational functions without needing credentials”.

The consequences of such unauthorized access are profound. An attacker could:

• Alter System Functions: Remotely change the way the device processes satellite signals.
• Modify Configurations: Change critical settings that could result in inaccurate positioning data.
• Disrupt Operations: Effectively knock the device offline or interfere with its ability to provide timing and navigation services, potentially stalling projects that rely on its precision.

For organizations utilizing these receivers in critical workflows, the risk is immediate. Carlson Software has moved to address the oversight.

Carlson Software recommends that all users of the VASCO-B GNSS Receiver update their systems to Version 1.4.0 or greater immediately. This update introduces the necessary security controls to prevent unauthenticated access.