NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a valid integer. Attackers can exploit the verbatim write of unvalidated strings into the pppd options file via write_config_option() to inject the plugin directive, causing the privileged pppd process to load an attacker-controlled shared object and achieve arbitrary code execution as root.
References
Configurations
No configuration.
History
23 Sep 2026, 19:19
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a valid integer. Attackers can exploit the verbatim write of unvalidated strings into the pppd options file via write_config_option() to inject the plugin directive, causing the privileged pppd process to load an attacker-controlled shared object and achieve arbitrary code execution as root. |
17 Sep 2026, 20:19
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-09-17 20:19
Updated : 2026-09-23 19:19
NVD link : CVE-2026-93337
Mitre link : CVE-2026-93337
CVE.ORG link : CVE-2026-93337
JSON object : View
Products Affected
No product.
CWE
CWE-88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')