Severity by source
Local vector since the attacker shapes on-host profile data (AV:L); low-privileged user can inject (PR:L) with no interaction; root pppd execution gives full C/I/A:H.
Lifecycle Timeline
4DescriptionCVE.org
[profile data reaches root pppd pty shell]
AnalysisAI
Attacker-influenced connection profile data can be routed into pppd's root-context pty/shell invocation in the ppp package (reported by Ubuntu), potentially letting a local user obtain code execution with the privileges of the pppd process. Our independent assessment scores this CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - local access is required, a connection must be initiated, and the target must actually use pppd for PPP/DSL/dial-up/mobile-broadband/VPN links, so exploitability is limited by how niche PPP is on modern systems; exploitation is not passive against a default configuration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to a system running pppd (the ppp package) where attacker-influenced profile/connection data is passed into pppd's pty or shell invocation - for example a NetworkManager PPP/DSL/mobile-broadband/VPN connection profile, or a pppd 'pty'/chat script parameter. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Data for this CVE is severely limited: no CVSS score, no CVSS vector, and no CWE were provided, and the only source is an Ubuntu vendor report with a one-line description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis, so remediation must start with compensating controls. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today