The vulnerability is a key‑exchange weakness that skips entity authentication during SSH handshakes, enabling an adversary in the middle to impersonate the server or client. This can lead to interception or modification of traffic, compromising confidentiality and integrity, and potentially facilitating further attacks. The weakness is identified as CWE‑322.

HAVELSAN Inc.’s Liman Render Engine versions 1.0 through 1.2‑74 are affected, as the vulnerability exists in any build before 1.2‑75.

The CVSS score of 5.9 classifies the issue as medium severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits yet. However, an attacker only needs network access to perform an SSH key exchange and can establish a man‑in‑the‑middle position, making exploitation straightforward for a motivated adversary. The risk therefore remains moderate, with potential for significant impact if the attacker gains a foothold.