CVE-2026-24790

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24790", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-02-05T19:05:16.840Z", "datePublished": "2026-02-20T16:15:21.374Z", "dateUpdated": "2026-02-20T18:59:34.973Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "OdorEyes EcoSystem Pulse Bypass System with XL4 Controller", "vendor": "Welker", "versions": [{"status": "affected", "version": "All versions"}]}], "credits": [{"lang": "en", "type": "finder", "value": "A project sponsored by DHS S&T reported this vulnerability to CISA."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The underlying PLC of the device can be remotely influenced, without proper safeguards or authentication."}], "value": "The underlying PLC of the device can be remotely influenced, without proper safeguards or authentication."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-02-20T16:15:21.374Z"}, "references": [{"url": "https://www.welker.com/contact-us/welker-team"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-050-04"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-050-04.json"}], "source": {"advisory": "ICSA-26-050-04", "discovery": "EXTERNAL"}, "title": "Welker OdorEyes EcoSystem Pulse Bypass System with XL4 Controller Missing Authentication for Critical Function", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Welker did not respond to CISA's attempts at coordination. Users of \nWelker OdorEyes devices are encouraged to contact Welker and keep their \nsystems up to date.\n\n<br>"}], "value": "Welker did not respond to CISA's attempts at coordination. Users of \nWelker OdorEyes devices are encouraged to contact Welker and keep their \nsystems up to date."}], "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-20T18:57:49.840358Z", "id": "CVE-2026-24790", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T18:59:34.973Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24790", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-20T18:57:49.840358Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T18:59:25.728Z"}}], "cna": {"title": "Welker OdorEyes EcoSystem Pulse Bypass System with XL4 Controller Missing Authentication for Critical Function", "source": {"advisory": "ICSA-26-050-04", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "A project sponsored by DHS S&T reported this vulnerability to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Welker", "product": "OdorEyes EcoSystem Pulse Bypass System with XL4 Controller", "versions": [{"status": "affected", "version": "All versions"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.welker.com/contact-us/welker-team"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-050-04"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-050-04.json"}], "workarounds": [{"lang": "en", "value": "Welker did not respond to CISA's attempts at coordination. Users of \nWelker OdorEyes devices are encouraged to contact Welker and keep their \nsystems up to date.", "supportingMedia": [{"type": "text/html", "value": "Welker did not respond to CISA's attempts at coordination. Users of \nWelker OdorEyes devices are encouraged to contact Welker and keep their \nsystems up to date.\n\n<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "The underlying PLC of the device can be remotely influenced, without proper safeguards or authentication.", "supportingMedia": [{"type": "text/html", "value": "The underlying PLC of the device can be remotely influenced, without proper safeguards or authentication.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-02-20T16:15:21.374Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24790", "state": "PUBLISHED", "dateUpdated": "2026-02-20T18:59:34.973Z", "dateReserved": "2026-02-05T19:05:16.840Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2026-02-20T16:15:21.374Z", "assignerShortName": "icscert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "OdorEyes EcoSystem Pulse Bypass System with XL4 Controller", "vendor": "Welker", "versions": [{"status": "affected", "version": "All versions"}]}], "source": "ics-cert@hq.dhs.gov"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The underlying PLC of the device can be remotely influenced, without proper safeguards or authentication."}, {"lang": "es", "value": "El PLC subyacente del dispositivo puede ser influenciado en remoto, sin autenticaci\u00f3n ni las salvaguardas adecuadas autenticaci\u00f3n."}], "id": "CVE-2026-24790", "lastModified": "2026-06-17T10:23:35.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24790", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-20T18:57:49.840358Z", "version": "2.0.3"}}]}, "published": "2026-02-20T17:25:51.313", "references": [{"source": "ics-cert@hq.dhs.gov", "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-050-04.json"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-050-04"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.welker.com/contact-us/welker-team"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "OdorEyes EcoSystem Pulse Bypass System with XL4 Controller", "source": "cna", "vendor": "Welker"}, "product": "odoreyes_ecosystem_pulse_bypass_system_with_xl4_controller", "vendor": "welker"}], "analysis": {"en": {"generated_at": "2026-04-17T17:22:03.888637+00:00", "value": {"mitigation_remediation": ["Apply any available vendor patch or firmware update for the OdorEyes EC System Pulse Bypass controller.", "If a patch is not yet released, isolate the device at the network perimeter using firewalls or segmentation to restrict inbound access to the PLC ports.", "Follow the vendor\u2019s recommended guidance: contact Welker, obtain the latest updates, and keep the system\u2019s software current."], "summary": {"action": "Assess Impact", "impact": "Remote Unauthorized Control"}, "threat_synthesis": {"affected_systems": "Welker\u2019s OdorEyes EcoSystem Pulse Bypass System with XL4 Controller is affected. Version details are not provided in the advisory, so all deployed units of this device are presumed vulnerable unless verified as patched.", "description_and_impact": "The vulnerability stems from missing authentication on a critical function of the PLC, allowing a remote actor to influence the device\u2019s internal logic without proper safeguards. Because the flaw is a lack of authentication (CWE-306), an attacker could trigger or manipulate these functions, potentially altering device behavior and undermining safety or security operations. The impact is primarily on integrity and availability of the system\u2019s normal functioning.", "risk_and_exploitability": "The advisory lists a CVSS base score of 8.2, indicating high severity, but the EPSS is reported as less than 1\u202f%, signifying a low probability of exploitation in the wild. The vulnerability is not currently in CISA\u2019s KEV catalog. The likely attack vector is remote, inferred from the statement that the PLC can be \u201cremotely influenced.\u201d Exploitation would require network connectivity to the PLC and an understanding of its exposed interfaces, but no specific authentication or privilege prerequisites are disclosed in the description."}}}}, "created": "2026-02-23T14:35:41.305671+00:00", "updated": "2026-04-17T17:30:23.861151+00:00", "vendors": ["welker", "welker$PRODUCT$odoreyes_ecosystem_pulse_bypass_system_with_xl4_controller"]}