CVE-2026-75131: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in nm-l2tp NetworkManager-l2tp
NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a crafted VPN username. Attackers can embed a double-quote character or whitespace in the username to break out of the pppd options file quoting context and include the pppd plugin directive, causing the privileged pppd process to load an attacker-controlled shared object.
AI Analysis
Technical Summary
CVE-2026-75131 is a privilege escalation vulnerability in NetworkManager-l2tp through version 1.52.4. Local users authorized to create VPN connections can exploit improper neutralization of argument delimiters in the VPN username to inject arbitrary pppd options. By embedding double-quote characters or whitespace, attackers can break out of the quoting context in the pppd options file and include a pppd plugin directive that causes the privileged pppd process to load an attacker-controlled shared object, resulting in arbitrary code execution with root privileges. The issue is fixed in NetworkManager-l2tp version 1.52.6.
Potential Impact
Local users with permission to create VPN connections can escalate privileges to root by exploiting this vulnerability. The impact includes arbitrary code execution with root privileges, which can lead to full system compromise. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade NetworkManager-l2tp to version 1.52.6 or later, where this vulnerability is fixed. Until the upgrade is applied, restrict local user permissions to create VPN connections to trusted users only.
CVE-2026-75131: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in nm-l2tp NetworkManager-l2tp
Description
NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a crafted VPN username. Attackers can embed a double-quote character or whitespace in the username to break out of the pppd options file quoting context and include the pppd plugin directive, causing the privileged pppd process to load an attacker-controlled shared object.
CVSS v4.0
Score 8.5high
Affected software
nm-l2tp
NetworkManager-l2tp
pkg:github/NetworkManager-l2tpRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-75131 is a privilege escalation vulnerability in NetworkManager-l2tp through version 1.52.4. Local users authorized to create VPN connections can exploit improper neutralization of argument delimiters in the VPN username to inject arbitrary pppd options. By embedding double-quote characters or whitespace, attackers can break out of the quoting context in the pppd options file and include a pppd plugin directive that causes the privileged pppd process to load an attacker-controlled shared object, resulting in arbitrary code execution with root privileges. The issue is fixed in NetworkManager-l2tp version 1.52.6.
Potential Impact
Local users with permission to create VPN connections can escalate privileges to root by exploiting this vulnerability. The impact includes arbitrary code execution with root privileges, which can lead to full system compromise. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade NetworkManager-l2tp to version 1.52.6 or later, where this vulnerability is fixed. Until the upgrade is applied, restrict local user permissions to create VPN connections to trusted users only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-17T18:39:57.661Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab4183ef7a7c541062636f9
Added to database: 09/23/2026, 18:19:42 UTC
Last enriched: 09/23/2026, 19:03:16 UTC
Last updated: 09/24/2026, 01:57:04 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.