NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a valid integer. Attackers can exploit the verbatim write of unvalidated strings into the pppd options file via writeconfigoption() to inject the plugin directive, causing the privileged pppd process to load an attacker-controlled shared object and achieve arbitrary code execution as root.

A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability in how the 'nameserver' setting is processed when establishing an iodine VPN connection. By embedding shell metacharacters (special characters that can execute commands) in the 'nameserver' value, an attacker can inject and execute arbitrary commands. These commands run with root privileges before the application drops its elevated permissions, leading to local privilege escalation.

A privilege escalation flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. When establishing an iodine VPN connection, nm-iodine-service passes the user-controlled "nameserver" setting from the connection profile to the iodine client binary on the command line without an option terminator. A nameserver value prefixed with "-d" can be reinterpreted by iodine's argument parser as the TUN device name option. Iodine truncates this device name to 15 bytes when calling the kernel's TUNSETIFF ioctl, but keeps the full (up to 250-byte) string in a global buffer that is later interpolated, unsanitized, into an ifconfig command executed via system(). Because this command runs before iodine drops privileges via chroot(), setgid(), and setuid(), a local unprivileged user can embed shell metacharacters in the nameserver value of a VPN connection profile to execute arbitrary commands as root.

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services.Security Fix(es): NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend (CVE-2026-10805) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services.Security Fix(es): NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend (CVE-2026-10805) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services.Security Fix(es): NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend (CVE-2026-10805) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services.Security Fix(es): NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend (CVE-2026-10805) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2025-9615 hardened private-connection FILE certificate and key paths in NetworkManager, but the directory-valued properties 802-1x.ca-path and phase2-ca-path were not included in that guard. An unprivileged user can set these properties on a private connection profile, and NetworkManager (running as root) passes capath/capath2 to wpasupplicant (also running as root) without the privateuser ownership check applied to the FILE-typed CA cert/key properties.

By pointing ca-path/phase2-ca-path at an attacker-controlled CA directory, an unprivileged local user can subvert WPA-Enterprise (802.1X) server certificate validation. On an existing corporate/eduroam profile, this lets an evil-twin AP pass certificate validation, allowing capture of the user's EAP credentials (e.g. MSCHAPv2 hash via hostapd-wpe in the reporter's PoC). The control case with /etc/ssl/certs was correctly rejected.

Scope: WPA-Enterprise (802.1X) networks only; not applicable to open or PSK networks. Requires an active local seat with the (typically passwordless) settings.modify.own permission; not exploitable via an inactive SSH session alone.

Reported by BreachX Zero Day Labs (BreachPoint Pvt Ltd, India) as part of a CERT-In coordinated disclosure also sent to Ubuntu Security and Debian Security, and copied to CERT-In (vdisclose.in). Internal reporter ID: CERT-IN-06-NM-CA-PATH.

Affected versions per reporter: Ubuntu NM 1.54.3, Kali 1.54.0, upstream tip 1.59.2-dev (commit 1947869) at time of report.

Reference: PSIRTSUPT-20440.

CVE-2025-9615 hardened private-connection FILE certificate and key paths in NetworkManager, but the directory-valued properties 802-1x.ca-path and phase2-ca-path were not included in that guard. An unprivileged user can set these properties on a private connection profile, and NetworkManager (running as root) passes capath/capath2 to wpasupplicant (also running as root) without the privateuser ownership check applied to the FILE-typed CA cert/key properties.

By pointing ca-path/phase2-ca-path at an attacker-controlled CA directory, an unprivileged local user can subvert WPA-Enterprise (802.1X) server certificate validation. On an existing corporate/eduroam profile, this lets an evil-twin AP pass certificate validation, allowing capture of the user's EAP credentials (e.g. MSCHAPv2 hash via hostapd-wpe in the reporter's PoC). The control case with /etc/ssl/certs was correctly rejected.

Scope: WPA-Enterprise (802.1X) networks only; not applicable to open or PSK networks. Requires an active local seat with the (typically passwordless) settings.modify.own permission; not exploitable via an inactive SSH session alone.

Reported by BreachX Zero Day Labs (BreachPoint Pvt Ltd, India) as part of a CERT-In coordinated disclosure also sent to Ubuntu Security and Debian Security, and copied to CERT-In (vdisclose.in). Internal reporter ID: CERT-IN-06-NM-CA-PATH.

Affected versions per reporter: Ubuntu NM 1.54.3, Kali 1.54.0, upstream tip 1.59.2-dev (commit 1947869) at time of report.

Reference: PSIRTSUPT-20440.

A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description (MUD) URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL, provided an administrator has explicitly configured NetworkManager to use dhclient. This issue does not affect default configurations of NetworkManager.

A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description (MUD) URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL, provided an administrator has explicitly configured NetworkManager to use dhclient. This issue does not affect default configurations of NetworkManager.

A flaw was found in NetworkManager. NetworkManager package allows access files that may belong to other users. NetworkManager allows non-root users to configure the network on the system. The daemon runs as root and, as such, is able to access files that are owned by users different from the one who added the connection.

A flaw was found in NetworkManager. When a system running NetworkManager with DEBUG logs enabled and an interface eth1 configured with LLDP enabled, a malicious user could inject a malformed LLDP packet. NetworkManager would crash, leading to a denial of service.

Given a system running NetworkManager with DEBUG logs enabled and an interface eth1 configured with LLDP enabled, someone could inject a malformed LLDP packet and NetworkManager would crash leading to a DoS.

It was found that NetworkManager, a network devices and connections manager, did not properly enforce the PolicyKit 'authadmin' action element settings (did not require authentication by an administrative user), when the 'authadmin' element was specified in org.freedesktop.network-manager-settings.system.wifi.share.open (connection sharing via an open WiFi network) action. A local attacker could use this flaw to setup an unsecure (passwordless) Ad-Hoc wireless network.

+++ This bug was initially created as a clone of Bug #546115 +++

nm-connection-editor may inadvertently publish network configuration settings over D-Bus when a user changes those settings using the connection editor. D-Bus gives all clients a bus name (usually 1:XXX where XXX is an ever-increasing number) whenever the client connects to the bus. Even though this client is not exporting a /named/ service, it is still on the bus and if the client exports an object (even inadvertently, without registering a well-known bus name) signals emitted by that object will also be proxied onto the bus.

nm-connection-editor inadvertently exported connection objects on the bus, and when a user changes those connections though the connection editor GUI, the editor may emit a summary of those changes onto the bus, leading to the information disclosure.

1) start 'dbus-monitor --system' in a terminal 2) run nm-connection-editor 3) edit a connection that has secrets, like a protected wifi network 4) Upon clicking the "Apply" button, check the dbus-monitor terminal window; the wifi network password may have been emitted as part of the "Updated" signal for that connection

This is only a problem for NM 0.7.x present in Fedora <= 11 and RHEL5. The problem has been long corrected in NM 0.8 (F12+). Upstream commit to 0.7.x fixing this problem is here:

http://git.gnome.org/cgit/network-manager-applet/commit/?h=NETWORKMANAGERAPPLET07&id=8627880e07c8345f69ed639325280c7f62a8f894