EUVD-2026-75019
GHSA-3584-rwvv-wp47
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Local attack vector with low-privilege account sufficient; C:H and I:H reflect credential read and configuration write impact; no availability disruption.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
4DescriptionCVE.org
Incorrect Permission Assignment for Critical Resource vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus LightDM Greeter allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Pardus LightDM Greeter: before 0.4.15.
Articles & Coverage 1
AnalysisAI
Incorrect permission assignment on a critical resource in Pardus LightDM Greeter allows a local low-privileged user to read sensitive authentication material or tamper with greeter configuration, achieving high confidentiality and integrity impact without elevated rights. All versions before 0.4.15 of the greeter - a graphical login component shipped with Pardus, the Turkish government-backed Linux distribution maintained by TÜBİTAK BİLGEM - are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a valid local user account on the target system - no remote access vector applies; (2) the affected system must be running Pardus Linux with the Pardus LightDM Greeter package installed and active as the display manager; (3) the vulnerable version must be prior to 0.4.15. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.1 reflects a genuinely meaningful local privilege risk: low attack complexity (AC:L), no user interaction (UI:N), and only a low-privilege account required (PR:L), yielding high confidentiality and integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Pardus LightDM Greeter to version 0.4.15 or later, which corrects the file permission assignment for the critical resource. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of systems running Pardus LightDM Greeter, prioritizing government and critical infrastructure deployments, and document the current version on each system. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today