OTPulse

Welker OdorEyes EcoSystem Pulse Bypass System with XL4 Controller

Plan PatchCVSS 8.2ICS-CERT ICSA-26-050-04Feb 19, 2026
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

The Welker OdorEyes EcoSystem Pulse Bypass System with XL4 Controller contains a vulnerability that could allow an attacker without authentication to alter odorization control settings. Successful exploitation could result in over- or under-odorization events in odor control systems. The vulnerability affects all versions of the product, and the vendor has not responded to coordination attempts or provided a fix.

What this means
What could happen
An attacker could remotely adjust odorization levels in wastewater treatment or other odor control facilities, potentially causing insufficient odor masking (public health concern) or excessive odorization (operational inefficiency and potential equipment damage).
Who's at risk
Wastewater treatment plants and municipal odor control facilities using the Welker OdorEyes EcoSystem Pulse Bypass System with XL4 Controller for odorization management. This affects operators responsible for odor mitigation and environmental compliance at treatment facilities.
How it could be exploited
An attacker with network access to the XL4 Controller could send unauthenticated commands to alter odorization setpoints or bypass controls, disrupting the facility's odor management process. The network-accessible interface accepts requests without requiring valid credentials.
Prerequisites
  • Network access to the XL4 Controller on port(s) used by the OdorEyes system
  • No authentication credentials required
Remotely exploitableNo authentication requiredLow complexityNo patch availableVendor non-responsive
Exploitability
Unlikely to be exploited — EPSS score 0.1%
Affected products (1)
ProductAffected VersionsFix Status
OdorEyes EcoSystem Pulse Bypass System with XL4 Controller: vers:all/*All versionsNo fix (EOL)
Remediation & Mitigation
0/5
Do now
0/2
WORKAROUNDRestrict network access to the XL4 Controller to only authorized workstations and SCADA systems using a firewall or network ACL on the port(s) used by OdorEyes
WORKAROUNDDeploy a firewall rule to block inbound connections to the XL4 Controller from untrusted networks outside the water/wastewater treatment facility
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HARDENINGEstablish continuous monitoring and alerting on odorization setpoint changes to detect unauthorized modifications
WORKAROUNDContact Welker for alternative products or security guidance, and document communication attempts
Mitigations - no patch available
0/1
OdorEyes EcoSystem Pulse Bypass System with XL4 Controller: vers:all/* has reached End of Life. The vendor will not release a patch. Apply the following compensating controls:
HARDENINGImplement network segmentation to isolate the OdorEyes system on a dedicated control network separate from general facility networks
View full CISA ICS-CERT advisory
API: /api/v1/advisories/b22cc366-b2ec-404f-bd7c-01514d39c221

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Welker OdorEyes EcoSystem Pulse Bypass System with XL4 Controller | CVSS 8.2 - OTPulse