This vulnerability exists in NetworkManager-sstp, where unescaped shell metacharacters embedded by a local unprivileged user in VPN connection profile fields (such as CA certificate or proxy settings) are passed to the pppd daemon running as root. This improper neutralization of special elements leads to OS command injection, enabling arbitrary command execution with root privileges upon activation of a malicious VPN connection. The vulnerability has a CVSS 3.1 score of 7.8 (high severity). Red Hat's advisory states that no currently supported Red Hat products are affected. The vulnerability requires local access and activation of a malicious VPN profile.

Successful exploitation allows a local unprivileged user to execute arbitrary commands with root privileges, potentially leading to full system compromise including unauthorized code execution, data modification, denial of service, and hiding of malicious activities. The attack vector requires local user interaction to activate a crafted VPN connection profile.

Red Hat states that no currently supported Red Hat products are affected by this vulnerability. If NetworkManager-sstp is not required, removing the package eliminates the attack vector. This can be done using the command: sudo dnf remove NetworkManager-sstp. Removal may impact functionality relying on SSTP VPN connections. There is no official patch or fix indicated in the advisory; users should monitor vendor advisories for updates.