CVE-2026-19624

Katalog CVE

CVSS 7.8 · High EPSS 0,13%

Kerentanan Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'). Skor CVSS 3.1 7.8 (High) menurut puiterwijk.org.

Deskripsi (NVD)

A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a newline-injected leftupdown directive; pluto executes that command as root when the IKE security association is established, resulting in local privilege escalation. This is the same bug class as CVE-2018-10900 (NetworkManager-vpnc).

Rincian

Terbit di NVD

14 September 2026

Terakhir diubah

18 September 2026

Status NVD

Awaiting Analysis

CVSS 3.1

7.8 (High), sumber puiterwijk.org
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

0,13% peluang dieksploitasi; lebih tinggi dari 2,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://bodhi.fedoraproject.org/updates/?packages=NetworkManager-l2tp
• https://github.com/nm-l2tp/NetworkManager-l2tp/commit/3704d8c9d5e5f9ed1626a8ce7627a04247cea673
• https://github.com/nm-l2tp/NetworkManager-l2tp/commit/95b6b46f48a0c9eabc79272cd313f219110ef91c
• https://github.com/nm-l2tp/NetworkManager-l2tp/releases
• https://linnemanlabs.com/posts/nm-l2tp-newline-to-root/