CVE-2026-93337
NetworkManager-l2tp Privilege Escalation via pppd Plugin Injection
CVSS Score
7.8
EPSS Score
0.0%
EPSS Percentile
0th
NetworkManager-l2tp contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a valid integer. Attackers can exploit the verbatim write of unvalidated strings into the pppd options file via write_config_option() to inject the plugin directive, causing the privileged pppd process to load an attacker-controlled shared object and achieve arbitrary code execution as root.
| CWE | CWE-88 |
| Vendor | nm-l2tp |
| Product | networkmanager-l2tp |
| Published | Sep 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for nm-l2tp networkmanager-l2tp
Be the first to know when new high vulnerabilities affecting nm-l2tp networkmanager-l2tp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
nm-l2tp / NetworkManager-l2tp
0 ≤ 1.52.4
References
github.com: https://github.com/nm-l2tp/NetworkManager-l2tp/security/advisories/GHSA-rp84-8h2r-5xc3 github.com: https://github.com/nm-l2tp/NetworkManager-l2tp/commit/64879ce0ad866f7c9a45babe4d95731a916ea00f vulncheck.com: https://www.vulncheck.com/advisories/networkmanager-l2tp-privilege-escalation-via-pppd-plugin-injection
Credits
Andres Berbescu (4drez)