CyberRota Analysis
AI-GeneratedA vulnerability in the NetworkManager-l2tp plugin allows local unprivileged users to inject malicious commands into the ipsec.conf file, which is executed with root privileges by the pluto daemon during the establishment of IKE security associations. This flaw can lead to local privilege escalation, enabling attackers to gain elevated access to the system. Organizations using NetworkManager-l2tp should prioritize patching this vulnerability to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a newline-injected leftupdown directive; pluto executes that command as root when the IKE security association is established, resulting in local privilege escalation. This is the same bug class as CVE-2018-10900 (NetworkManager-vpnc).