EUVD-2026-66426
GHSA-7wqv-c2hc-jg8f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Hard-coded credentials are network-reachable and trivially usable (AV:N/AC:L/PR:N/UI:N); bypass grants read/write to management data (C:H/I:H) with no inherent availability impact (A:N).
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
Use of Hard-coded Credentials vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Try Common or Default Usernames and Passwords.
This issue affects Liderahenk: before 3.5.5.
AnalysisAI
Hard-coded credentials in TÜBİTAK BİLGEM's Liderahenk Linux endpoint management platform (all versions before 3.5.5) let a remote, unauthenticated attacker log in using built-in default/common username-password pairs, yielding an authentication bypass with high confidentiality and integrity impact. Because Liderahenk centrally administers fleets of Pardus/Linux clients, valid access to its management interface exposes managed-endpoint policies and configuration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of Liderahenk, since the credentials are hard-coded and shipped with the product (CVSS PR:N/UI:N/AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are consistent and point to genuine priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to a Liderahenk server (before 3.5.5) submits the software's hard-coded/default credentials to the management interface and is authenticated without any prior access, then reads or alters central endpoint-management policy and configuration for the managed Linux fleet. Because the credentials are static and identical across installations, exploitation is scriptable and requires no user interaction; no public exploit is identified at time of analysis, but the low complexity makes independent rediscovery of the credentials straightforward. |
| Remediation | Vendor-released patch: 3.5.5 - upgrade all Liderahenk installations to version 3.5.5 or later, which is the first release outside the affected 'before 3.5.5' range, per the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0916. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Liderahenk deployments, document current versions and managed endpoint counts, and restrict network access to the management interface using firewall rules or network segmentation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Liderahenk
View allOn 2.1.15 version and below of Lider module in LiderAhenk software is leaking it's configurations via an unsecured API.
LDAP Injection in Liderahenk, TÜBİTAK BİLGEM's centralized Linux management platform, enables unauthenticated remote att
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today