Description

A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a newline-injected leftupdown directive; pluto executes that command as root when the IKE security association is established, resulting in local privilege escalation. This is the same bug class as CVE-2018-10900 (NetworkManager-vpnc).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-14T20:16:43.593Z",
  "pubdate": "2026-09-14T20:16:43.593Z",
  "executiveSummary": "A critical command injection vulnerability exists in NetworkManager-l2tp due to improper sanitization of VPN connection properties.\nThe vulnerability allows a local unprivileged user to execute arbitrary commands with root privileges.\nThe root cause involves the plugin writing attacker-controlled values (vpn.data and vpn.secrets) into the generated ipsec.conf file without sufficient escaping, leading to newline injection.\nWhen the pluto daemon parses the malicious configuration as the root user during the establishment of an IKE security association, the injected commands are executed.\nThis vulnerability is functionally identical to the flaw identified in CVE-2018-10900 (NetworkManager-vpnc).\nThe risk is high as it enables local privilege escalation, allowing an attacker to bypass standard security boundaries on the host system.\nExploitation requires the attacker to have the ability to create and activate a local L2TP VPN profile on the affected system.",
  "technicalDetails": "The vulnerability resides within the NetworkManager-l2tp plugin, which is responsible for managing L2TP-based VPN connections.\nThe plugin architecture requires generating configuration files for the underlying IPsec daemon, known as pluto, to initiate IKE security associations.\nThe defect occurs because the plugin fails to perform adequate input validation or escaping on user-supplied VPN connection properties, specifically those stored within the vpn.data and vpn.secrets fields.\nBecause these fields are written directly into the ipsec.conf file used by pluto, an attacker can perform newline injection (CRLF injection) to append arbitrary configuration directives.\nSpecifically, an attacker can inject a malicious 'leftupdown' directive into the generated configuration file.\nThe 'leftupdown' directive is an IPsec configuration option that specifies a script to be executed when the security association is established or torn down.\nBecause the pluto daemon operates with root privileges to manage system-level networking and cryptographic operations, any script or command assigned to the 'leftupdown' directive is executed with elevated root permissions.\nThe attack flow follows these steps: First, an unprivileged user creates a malicious VPN profile via NetworkManager, embedding a crafted payload containing a newline followed by the desired command in the VPN properties. Second, the user initiates the VPN connection. Third, the NetworkManager-l2tp plugin generates the ipsec.conf file, unknowingly including the attacker's injected command. Fourth, the pluto daemon loads the malicious configuration file. Fifth, upon the establishment of the IKE security association, the pluto daemon invokes the injected command as root.\nThis flaw is categorized as a command injection vulnerability, sharing the same exploitation logic as CVE-2018-10900. It demonstrates a failure to treat user-controlled input as untrusted data before using it in the construction of system-level configuration files. The successful exploitation results in complete system compromise as the attacker gains the effective user ID of root. No network exposure is required to trigger the initial configuration generation, as the attack is initiated locally by the user through the local VPN management interface."
}