Liderahenk EUVD-2026-66426

No special conditions - remote unauthenticated exploitation against default configurations of Liderahenk, since the credentials are hard-coded and shipped with the product (CVSS PR:N/UI:N/AC:L). The only practical limiting factor is network reachability of the Liderahenk management service: the attacker must be able to reach its network interface (AV:N), so deployments where the management port is confined to an isolated administrative segment or VPN are materially harder to reach. No specific non-default feature toggle, platform, or user interaction is required.

Signals are consistent and point to genuine priority. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (base 9.1, Critical) describes remote, network-reachable exploitation with low complexity and no privileges or user interaction - a near-worst-case access profile - with high confidentiality and integrity impact but no availability impact, matching an authentication bypass rather than a crash/DoS. Hard-coded credentials are inherently 'automatable' and trivially weaponizable once the values are known, which reasonably maps to an SSVC exploitation posture of at least 'poc'/high-automatable even though no formal SSVC decision was supplied. Counterbalancing this, EPSS was not provided, the flaw is NOT in CISA KEV, and no POC or active-exploitation evidence exists in the input, so there is no confirmation of widespread real-world exploitation yet - the elevated risk is driven by the credential-bypass nature and network exposure, not by observed attacks. Given the product's deployment in Turkish public-sector Linux fleets, any operator running a version before 3.5.5, even a mid-sized municipal or agency IT team, should treat internet- or LAN-exposed Liderahenk management interfaces as urgent to patch.

An attacker with network access to a Liderahenk server (before 3.5.5) submits the software's hard-coded/default credentials to the management interface and is authenticated without any prior access, then reads or alters central endpoint-management policy and configuration for the managed Linux fleet. Because the credentials are static and identical across installations, exploitation is scriptable and requires no user interaction; no public exploit is identified at time of analysis, but the low complexity makes independent rediscovery of the credentials straightforward.