nm-l2tp NetworkManager-l2tp up to 1.52.4/1.52.5 VPN Connection Username privileges management

Summaryinfo

A vulnerability described as very critical has been identified in nm-l2tp NetworkManager-l2tp up to 1.52.4/1.52.5. This affects an unknown part of the component VPN Connection. The manipulation of the argument Username results in privileges management. This vulnerability is reported as CVE-2026-75131. The attack requires a local approach. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in nm-l2tp NetworkManager-l2tp up to 1.52.4/1.52.5. It has been classified as very critical. Affected is an unknown code block of the component VPN Connection. The manipulation of the argument username with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a crafted VPN username. Attackers can embed a double-quote character or whitespace in the username to break out of the pppd options file quoting context and include the pppd plugin directive, causing the privileged pppd process to load an attacker-controlled shared object.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-75131 since 08/17/2026. The exploitability is told to be easy. The attack needs to be approached locally. Additional levels of successful authentication are required for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/23/2026). The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 1.52.6 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• nm-l2tp

Name

• NetworkManager-l2tp

Version

• 1.52.0
• 1.52.1
• 1.52.2
• 1.52.3
• 1.52.4
• 1.52.5

Website

• Product: https://github.com/nm-l2tp/NetworkManager-l2tp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion