The vulnerability is a missing authentication check on a critical function in the Liderahenk application. This flaw allows attackers to perform remote code inclusion, privilege abuse, and command injection, giving them the ability to execute arbitrary code with the privileges of the service. The weakness is classified as CWE‑306, reflecting the lack of proper authentication controls.

The affected product is Liderahenk, produced by the TUBITAK BILGEM Software Technologies Research Institute. All versions earlier than 3.5.1 are vulnerable; newer releases contain the fix.

The CVSS score is 7.5, indicating a high severity. The EPSS score is less than 1%, suggesting a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers can likely exploit the flaw remotely over the network by sending a crafted request to the unauthenticated endpoint. The likely attack vector is inferred to be a network-based request to an unauthenticated endpoint, as detailed in the description. While the likelihood of exploitation is low, the potential impact of arbitrary code execution warrants urgent attention.