The GPL Odorizers GPL750 (XL4) device is vulnerable to unauthorized remote manipulation via Modbus protocol packets. An attacker with low privileges can alter register values that serve as inputs to the odorant injection logic. This can result in injecting either too much or too little odorant into a gas line, which is a safety-critical function. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function) and has a CVSS 3.1 score of 8.6, indicating high severity. No patch or official remediation guidance has been published by the vendor, and the device is not a cloud service. No known exploits have been observed in the wild.

The impact of this vulnerability is high because it allows a remote attacker without privileges to alter the amount of odorant injected into a gas line. Incorrect odorant levels can compromise gas leak detection safety measures, potentially leading to hazardous conditions. There is no impact on confidentiality or availability reported, but the integrity of the odorant injection process is fully compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider restricting network access to the Modbus interface of the GPL750 (XL4) device to trusted sources only and monitor for unauthorized Modbus traffic. No official remediation or temporary fix has been provided by the vendor as of the publication date.