Keith Linneman

**Name of the Vulnerable Software and Affected Versions** NetworkManager-l2tp (affected versions not specified) **Description** A flaw exists where the plugin writes attacker-controlled VPN connection properties, specifically `vpn.data` and `vpn.secrets` values, unescaped into a generated ipsec.conf file. Because pluto loads this file as root, a local unprivileged user can create and activate an L2TP VPN profile containing a newline-injected leftupdown directive. This allows pluto to execute the injected command as root during the establishment of the IKE security association, leading to local privilege escalation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.