Liman MYS: Weak password recovery mechanism for forgotten passwords
Summary
HAVELSAN's Liman MYS, a platform for central management of servers, clients and network devices, has a weak password recovery mechanism according to the NVD record (CVSS 8.1). The CVSS vector indicates that an unauthenticated attacker on the network could gain high confidentiality and integrity impact, but user interaction is required. Some feeds describe the flaw differently (as Host Header Injection), and the vendor and CSIRT advisory could not be verified, so the exact mechanism and preconditions are not yet confirmed.
Affected
- Liman MYS from 2.3.4-1124 before 2.3.5-1131 (NVD record)
- VulDB describes the range as up to 2.3.5-1130; whether earlier builds are affected is unknown.
Fixed in
- Version 2.3.5-1131 is reported as fixed by a third-party aggregator; not verified against the vendor.
Workaround
- Unknown. The CVE record provides no vendor workaround.
- Interim measure (own recommendation, not a vendor measure): restrict access to the management interface to internal or VPN networks.
Exploitation
- CISA SSVC: Exploitation none, Automatable no.
- Not listed in CISA KEV.
- VulDB: no exploit available. OffSeq: not known to be exploited.
- No public proof of concept found.
Our recommendation
- Inventory all Liman MYS instances and their versions.
- Plan the upgrade to 2.3.5-1131 or later and confirm the fixed version directly with HAVELSAN.
- Restrict management interface exposure to internal or VPN networks.
- Review administrator accounts for unexpected password resets.
- Recheck the CSIRT advisory TR-26-1396 and the NVD record, which is currently Deferred.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Turkish CSIRT advisory TR-26-1396 siberguvenlik.gov.tr
- OpenCVE record CVE-2026-94380 app.opencve.io
- VulDB entry 426394 vuldb.com
- OffSeq radar (fixed version, third-party) radar.offseq.com
- CNNVD mirror via Vulners vulners.com
- OffSeq threat page (exploitation status) radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:54.
Original description (NVD)
Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation. This issue affects Liman MYS: from 2.3.4-1124 before 2.3.5-1131.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.