CVE-2026-6207: User Enumeration in in HAVELSAN's Geographic Tracking System

Synopsis

An observable response discrepancy vulnerability (user enumeration) affects HAVELSAN Inc.'s Geographic Tracking System in versions before v0.0.2. The flaw is reachable over the network with no authentication or user interaction required, allowing an attacker to probe the system and enumerate valid user accounts by observing differences in server responses. Successful exploitation gives the attacker a map of valid usernames and system structure, and also enables tampering with data. A patched-image rebuild at v0.0.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker sends crafted requests remotely with no need for local access.

• AuthenticationNot required

  No credentials of any kind are needed; the attacker can probe the system as an unauthenticated user.

• Victim interactionNot required

  No user interaction is required; the attacker operates entirely without involving a legitimate user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites.

Blast Radius

• An attacker enumerates valid usernames by comparing server response differences, building a target list for follow-on credential attacks.
• Confidential data held by the system is exposed, including user account details and system structure information derived from footprinting.
• An attacker with enumerated account knowledge can tamper with or modify persisted data and system records within the Geographic Tracking System.