What is the CVSS score of EUVD-2026-34836?

EUVD-2026-34836 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Geographic Tracking System EUVD-2026-34836

| CVE-2026-6207 CRITICAL

Observable Response Discrepancy (CWE-204)

2026-06-05 TR-CERT

GHSA-3765-5f6w-7p86

Information Disclosure Geographic Tracking System Havelsan Inc

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Jun 22, 2026 - 06:03 cve.org

CRITICAL 9.1

Analysis Generated

Jun 05, 2026 - 15:00 vuln.today

DescriptionCVE.org

Observable response discrepancy vulnerability in HAVELSAN Inc. Geographic Tracking System allows System Footprinting.

This issue affects Geographic Tracking System: before v0.0.2.

AnalysisAI

Information disclosure in HAVELSAN Geographic Tracking System versions prior to v0.0.2 allows remote unauthenticated attackers to perform system footprinting by analyzing observable discrepancies in server responses. The CVSS 9.1 score reflects high confidentiality and integrity impact over the network with no authentication required, though no public exploit identified at time of analysis. The vulnerability was reported by Turkey's national CERT (TR-CERT), suggesting it primarily affects deployments within Turkey's defense and government sectors where HAVELSAN products are commonly used.

Technical ContextAI

HAVELSAN Inc. is a Turkish defense electronics and software company, and its Geographic Tracking System is a location/asset tracking platform typically used in defense, logistics, and government contexts. The root cause is CWE-204 (Observable Response Discrepancy), meaning the application returns measurably different responses - such as differing status codes, body content, timing, or error messages - depending on internal state, valid identifiers, or configuration. The CPE string cpe:2.3:a:havelsan_inc.:geographic_tracking_system:*:*:*:*:*:*:*:* covers all versions of the product prior to the fixed release. Such discrepancies enable attackers to enumerate users, internal hostnames, valid object identifiers, or backend technologies without ever bypassing authentication, effectively turning the application into an oracle.

RemediationAI

Upgrade Geographic Tracking System to version v0.0.2 or later, which the TR-CERT advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0325) identifies as the first fixed release - this is the primary and only confirmed fix. As compensating controls until patching, restrict network exposure of the tracking system to authenticated VPN segments or internal management networks rather than leaving any endpoint internet-reachable, which neutralizes the AV:N attack surface but may disrupt remote field users. Deploy a reverse proxy or WAF to normalize HTTP response codes, error bodies, and timing for endpoints handling identifiers or authentication, accepting that this may mask legitimate debugging signals. Increase logging and rate-limiting on enumeration-prone endpoints (login, lookup, search) so that footprinting attempts produce detectable patterns, with the trade-off of higher log volume.