Pardus Parental Control CVE-2026-9085

Exploitation requires local access to a Pardus host running Pardus-Parental-Control at version 0.5.1 or earlier, together with a low-privileged (non-root) local account (CVSS PR:L, AV:L) - no user interaction and no administrative rights are needed. The concrete prerequisite is the presence of the misconfigured critical resource (CWE-732): the DNS/filter configuration or associated component must carry permissions that allow the unprivileged user to write to it, which is the default state on affected versions. Limiting factors: the attack cannot be performed remotely and cannot be launched by an entirely unauthenticated outsider - the attacker must already be able to run code or interact locally on the device, and hosts upgraded to 0.7.0 or not running the product are not exploitable.

The CVSS 3.1 base score of 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is elevated primarily by the scope change (S:C) and full high impact across confidentiality, integrity, and availability. However, the vector is explicitly local (AV:L) and requires existing low privileges (PR:L), so this is not a remotely exploitable, internet-facing flaw - the real-world risk is bounded to attackers who already have a foothold or a low-privileged interactive session on the machine. No EPSS score, KEV listing, or SSVC decision data was provided, and no proof-of-concept is referenced, so there is no evidence of automation or active exploitation; this reads as a targeted local escalation/policy-bypass issue rather than a mass-exploited vulnerability. The classic scenario is a supervised user (e.g., a child or restricted staff member) deliberately defeating the very control the software enforces, which is a meaningful integrity concern for the product's purpose even though the raw 8.8 overstates urgency for a purely local vector.

A supervised, low-privileged user on a Pardus workstation logs into their normal account and, exploiting the overly permissive permissions on the parental-control DNS configuration, rewrites it to point at an attacker-chosen resolver. Subsequent name lookups for filtered or sensitive domains are answered by the malicious resolver, defeating parental filtering and enabling redirection or interception of the victim host's traffic. No proof-of-concept is publicly referenced, but the low-complexity local vector makes this straightforward for anyone with an account on the machine.