CVE-2018-10900

Name of the Vulnerable Software and Affected Versions Network Manager VPNC plugin versions prior to 1.2.6

Description The issue allows for a privilege escalation attack. An attacker can inject a Password helper parameter into the configuration data passed to VPNC by using a new line character, enabling the execution of arbitrary commands as root.

Recommendations For versions prior to 1.2.6, update to version 1.2.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the VPNC plugin to minimize the risk of exploitation.