EUVD-2026-41765
GHSA-686q-wrh7-cph5
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local, low-complexity abuse by an unprivileged user (AV:L/AC:L/PR:L); the permission flaw lets tampering alter system-wide DNS, justifying scope change and high C/I/A.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-Parental-Control allows DNS Spoofing.
This issue affects Pardus-Parental-Control: from <=0.5.1 before 0.7.0.
AnalysisAI
Local privilege abuse in TUBITAK BILGEM Pardus-Parental-Control (versions up to and including 0.5.1, fixed in 0.7.0) lets a low-privileged local user exploit insecure file/resource permissions to tamper with the tool's DNS configuration and perform DNS spoofing. Because the CVSS scope is changed (S:C), the impact reaches beyond the application to system-wide name resolution, enabling redirection of traffic, bypass of parental filtering, and interception of connections. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to a Pardus host running Pardus-Parental-Control at version 0.5.1 or earlier, together with a low-privileged (non-root) local account (CVSS PR:L, AV:L) - no user interaction and no administrative rights are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is elevated primarily by the scope change (S:C) and full high impact across confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A supervised, low-privileged user on a Pardus workstation logs into their normal account and, exploiting the overly permissive permissions on the parental-control DNS configuration, rewrites it to point at an attacker-chosen resolver. Subsequent name lookups for filtered or sensitive domains are answered by the malicious resolver, defeating parental filtering and enabling redirection or interception of the victim host's traffic. … |
| Remediation | Upgrade to Pardus-Parental-Control 0.7.0 or later, which is the vendor-designated fixed release, as documented in the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0500. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and document all systems running Pardus-Parental-Control with affected versions (≤0.5.1). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today