CVE-2025-9615 hardened private-connection FILE certificate and key paths in NetworkManager, but the directory-valued properties 802-1x.ca-path and phase2-ca-path were not included in that guard. An unprivileged user can set these properties on a private connection profile, and NetworkManager (running as root) passes capath/capath2 to wpasupplicant (also running as root) without the privateuser ownership check applied to the FILE-typed CA cert/key properties.
By pointing ca-path/phase2-ca-path at an attacker-controlled CA directory, an unprivileged local user can subvert WPA-Enterprise (802.1X) server certificate validation. On an existing corporate/eduroam profile, this lets an evil-twin AP pass certificate validation, allowing capture of the user's EAP credentials (e.g. MSCHAPv2 hash via hostapd-wpe in the reporter's PoC). The control case with /etc/ssl/certs was correctly rejected.
Scope: WPA-Enterprise (802.1X) networks only; not applicable to open or PSK networks. Requires an active local seat with the (typically passwordless) settings.modify.own permission; not exploitable via an inactive SSH session alone.
Reported by BreachX Zero Day Labs (BreachPoint Pvt Ltd, India) as part of a CERT-In coordinated disclosure also sent to Ubuntu Security and Debian Security, and copied to CERT-In (vdisclose.in). Internal reporter ID: CERT-IN-06-NM-CA-PATH.
Affected versions per reporter: Ubuntu NM 1.54.3, Kali 1.54.0, upstream tip 1.59.2-dev (commit 1947869) at time of report.
Reference: PSIRTSUPT-20440.
NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services.Security Fix(es): networkmanagr: NetworkManager File Access (CVE-2025-9615) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
GNOME NetworkManager allows remote attackers to cause a denial of service (IPv6 traffic disruption) via a crafted MTU value in an IPv6 Router Advertisement (RA) message, a different vulnerability than CVE-2015-8215.
Given a system running NetworkManager with DEBUG logs enabled and an interface eth1 configured with LLDP enabled, someone could inject a malformed LLDP packet and NetworkManager would crash leading to a DoS.
Description of problem:
Password to unlock certificate is logged to /var/log/messages
May 29 19:46:42 localhost NetworkManager[4791]: destroyonesecret: destroying
Version-Release number of selected component (if applicable):
NetworkManager-openvpn-0.8.999-1.fc15.x8664
Additional info:
I would love to have the option to type the password at connection time instead of it being stored, but adding the password to the system log is wrong
Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before 0.9.10.0-4ubuntu15.1, Ubuntu 14.10 before 0.9.8.8-0ubuntu28.1, and Ubuntu 14.04 LTS before 0.9.8.8-0ubuntu7.1 allows local users to change the modem device configuration or read arbitrary files via a .. (dot dot) in the file name in a request to read modem device contexts (com.canonical.NMOfono.ReadImsiContexts).
Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to inject a Password helper parameter into the configuration data passed to VPNC, allowing an attacker to execute arbitrary commands as root.
A flaw was found in NetworkManager in versions before 1.30.0. Setting match.path and activating a profile crashes NetworkManager. The highest threat from this vulnerability is to system availability.
It was found that NetworkManager, a network devices and connections manager, did not properly enforce the PolicyKit 'authadmin' action element settings (did not require authentication by an administrative user), when the 'authadmin' element was specified in org.freedesktop.network-manager-settings.system.wifi.share.open (connection sharing via an open WiFi network) action. A local attacker could use this flaw to setup an unsecure (passwordless) Ad-Hoc wireless network.