Andres Berbescu

**Name of the Vulnerable Software and Affected Versions** NetworkManager-l2tp (affected versions not specified) **Description** Improper input validation allows local users with VPN connection creation permissions to inject arbitrary pppd directives. By providing `mru` or `mtu` property values that contain non-numeric content following a valid integer, an attacker can exploit the `write config option()` function, which writes unvalidated strings directly into the pppd options file. This allows the injection of a plugin directive, leading the privileged pppd process to load a malicious shared object and execute arbitrary code with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NetworkManager-l2tp versions 1.0 through 1.52.4 **Description** A privilege escalation issue exists that allows local users with permission to create VPN connections to execute arbitrary code as root. An attacker can inject pppd options by using a crafted VPN username containing a double-quote character or whitespace. This allows the attacker to break out of the pppd options file quoting context and include the pppd plugin directive, which forces the privileged pppd process to load an attacker-controlled shared object. **Recommendations** Update NetworkManager-l2tp to version 1.52.6.