CVE-2026-19624highCWE-88

CVE-2026-19624: falha de alta gravidade em NetworkManager-l2tp

NetworkManager-l2tp: local privilege escalation via ipsec.conf injection

Publicada em

Seguir esta CVE+ Monitorar Fedora+ Monitorar Extra Packages for Enterprise Linux

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.8epss 0.1%
A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a newline-injected leftupdown directive; pluto executes that command as root when the IKE security association is established, resulting in local privilege escalation. This is the same bug class as CVE-2018-10900 (NetworkManager-vpnc).
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
NetworkManager-l2tpFedora · Extra Packages for Enterprise Linux (EPEL)Fedora · Fedora
CVEs relacionadas — NetworkManager-l2tp

No mesmo produto, das mais perigosas para as menos.

CVE-2023-1183MEDIUMArbitrary file writeEPSS 64.9%CVE-2023-3338MEDIUMCrash due to a null pointer dereference in the dn_nsp_send functionEPSS 8.5%CVE-2023-6246HIGHGlibc: heap-based buffer overflow in __vsyslog_internal()EPSS 4.8%CVE-2023-32248HIGHTree connection null pointer dereference denial-of-service vulnerabilityEPSS 4.1%CVE-2023-32252HIGHSession null pointer dereference denial-of-service vulnerabilityEPSS 4.1%CVE-2023-32247HIGHSession setup memory exhaustion denial-of-service vulnerabilityEPSS 3.9%