theoretically, cheating from the listen server can take any form you can imagine. If there is a variable replicated from the listen server, then it can be hacked, and it will then replicate to all clients.
Even if it doesn’t replicate, it will at least affect the server player.
So you name it. If it’s a variable it can be changed, and (though more difficult) if it’s a function it can be called.
The way unreal’s networking architecture prevents cheating is that things only replicate from server to client, with the exception of some kinds of remote procedure calls, which are part of your design for your game. However, this doesn’t prevent the server player themselves from hacking their own game running on the server side.
So dedicated server means every player is a client, so any hacking they do to their own game affects only them, and then the server corrects them next replication and says “No… THIS is what happened, and how it happened,” which is the version of reality all the players get set to by the server anyway.
So yeah, health, lives, score, speed, location, size, inventory, leveling up, ANYTHING.
This was often a problem back in 1998 with networked games of Worms 2 (made by Team17, not an Unreal game). People would host listen servers and then when things didn’t go their way, they’d cheat and suddenly give themselves a hacked minigun where each bullet does the largest explosion possible in the game. I still beat that guy by the way, mostly by luck and some great jumping skills getting me across the few pixels left of the landscape, as his bullet spread was too much to hit me from so far away, and to hit any of the tiny shreds of land I was standing on. Eventually he just messed up and fell in the water himself.