CyberRota Analysis
AI-GeneratedNetworkManager-l2tp is vulnerable due to improper input validation, allowing local users with VPN creation permissions to inject arbitrary pppd directives by including trailing non-numeric content in the mru or mtu property values. This can lead to arbitrary code execution with root privileges, as the unvalidated strings are written directly into the pppd options file. Organizations utilizing NetworkManager-l2tp should prioritize patching this vulnerability to mitigate the risk of exploitation by malicious insiders.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a valid integer. Attackers can exploit the verbatim write of unvalidated strings into the pppd options file via write_config_option() to inject the plugin directive, causing the privileged pppd process to load an attacker-controlled shared object and achieve arbitrary code execution as root.