EUVD-2026-82381Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with low complexity; PR:L reflects the required VPN-creation permission; injection yields full root code execution so C/I/A all High, scope Unchanged as the escalation stays on-host.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
NetworkManager-l2tp contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a valid integer. Attackers can exploit the verbatim write of unvalidated strings into the pppd options file via write_config_option() to inject the plugin directive, causing the privileged pppd process to load an attacker-controlled shared object and achieve arbitrary code execution as root.
Articles & Coverage 1
AnalysisAI
Local privilege escalation to root in NetworkManager-l2tp: a local user who holds NetworkManager VPN-connection-creation permission (typically granted through polkit on a desktop or shared Linux host) can smuggle an arbitrary pppd 'plugin' directive into the root-owned pppd options file by setting the L2TP connection's mru or mtu property to a valid integer followed by trailing non-numeric text, for example '1400 plugin /tmp/evil.so'. Because the plugin directive is consumed by the privileged pppd process when the crafted VPN connection is activated, pppd loads an attacker-controlled shared object and executes code as root. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a local account that has been granted NetworkManager VPN-connection-creation permission (typically via polkit on a desktop or shared Linux host) - this is the PR:L gate and the primary limiter, so arbitrary unprivileged users cannot exploit it unless given VPN management rights. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority local privilege-escalation-to-root, not a high-CVSS-but-low-impact issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upstream fix commit 64879ce0ad866f7c9a45babe4d95731a916ea00f (https://github.com/nm-l2tp/NetworkManager-l2tp/commit/64879ce0ad866f7c9a45babe4d95731a916ea00f), referenced by the vendor advisory https://github.com/nm-l2tp/NetworkManager-l2tp/security/advisories/GHSA-rp84-8h2r-5xc3; a released patched version number is not independently confirmed from the provided data, so update NetworkManager-l2tp to the newest build offered by your distribution once it carries this commit. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems running NetworkManager-l2tp, confirm the installed version against the vendor advisory, and apply the vendor-released NetworkManager-l2tp update where operationally feasible; if immediate patching is not possible, temporarily restrict polkit permissions that grant VPN-connection-creation to only trusted administrators. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today