What is the CVSS score of CVE-2026-1617?

CVE-2026-1617 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Turkhotspot 5651 Loglama are affected by CVE-2026-1617?

Turkhotspot 5651 Loglama versions 5.1.2 contain a critical SQL injection vulnerability (CVSS 9.8) that could allow attackers to access and tamper with legally mandated user-activity audit logs…. A patch is available.

How to fix or mitigate CVE-2026-1617?

Within 24 hours, inventory all Turkhotspot 5651 Loglama 5.1.2 instances in production and restrict network access to the appliance if operationally feasible; verify current versions across all deployments. Within 7 days, upgrade all affected 5.1.2 instances to version 5.1.3 to remediate the SQL injection vulnerability. Within 30 days, conduct forensic analysis of database access logs to identify any unauthorized SQL injection exploitation attempts, implement network segmentation around the appliance, and validate the integrity of all audit logs required for Law 5651 compliance.

Turkhotspot 5651 Loglama CVE-2026-1617

EUVD-2026-46175 CRITICAL

SQL Injection (CWE-89)

2026-07-21 TR-CERT

GHSA-vhgq-f53c-h5mp

SQLi Turkhotspot 5651 Loglama

9.8

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.4 CRITICAL

Unauthenticated network-reachable SQLi (AV:N/AC:L/PR:N/UI:N) yields full data read and write (C:H/I:H); availability lowered to A:L as SQLi rarely causes full outage absent destructive stacked queries.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 21, 2026 - 13:17 EUVD

Analysis Generated

Jul 21, 2026 - 12:00 vuln.today

CVE Published

Jul 21, 2026 - 11:07 cve.org

CRITICAL 9.8

DescriptionCVE.org

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Turkmesh Communication Services Inc. Turkhotspot 5651 Loglama allows SQL Injection.

This issue affects Turkhotspot 5651 Loglama: from 5.1.2 before 5.1.3.

AnalysisAI

SQL injection in Turkhotspot 5651 Loglama versions 5.1.2 through 5.1.2 (fixed in 5.1.3) allows remote attackers to inject arbitrary SQL commands, per TR-CERT advisory TR-26-0584. The product is a Turkish Law 5651 network-access logging/hotspot compliance appliance, and successful exploitation exposes the backing database that stores legally mandated user-activity logs. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected software, Turkhotspot 5651 Loglama, is a Turkish hotspot access-management and logging solution built to satisfy Law No. 5651 (the 'Loglama'/logging mandate requiring ISPs and public Wi-Fi operators to retain connection records). The flaw is classified as CWE-89, Improper Neutralization of Special Elements used in an SQL Command, meaning user-controllable input reaches a database query without proper parameterization or escaping, letting an attacker alter query structure. The single CPE cpe:2.3:a:turkmesh_communication_services_inc.:turkhotspot_5651_loglama:*:*:*:*:*:*:*:* confirms this is application-level software from vendor Turkmesh Communication Services Inc., and given the product function the database holds sensitive subscriber and connection-log data.

RemediationAI

Upgrade to Turkhotspot 5651 Loglama version 5.1.3, which per the version range is the fixed release (Vendor-released patch: 5.1.3); consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0584 for vendor guidance. If immediate patching is not possible, restrict network reachability of the management/portal interface to trusted administrative networks or VPN rather than exposing it to the public internet, and place a WAF or database-activity monitoring rule in front of the application to block classic SQLi patterns on the vulnerable parameters - noting that WAF signatures can be bypassed and may false-positive on legitimate portal input, so they are a stopgap, not a fix. Given this appliance stores legally mandated 5651 logs, also review database accounts to enforce least privilege so a successful injection cannot escalate beyond read access.