CVE-2018-10900

HIGH

Network Manager VPNC Username Privilege Escalation

Title source: metasploit

Description

Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to inject a Password helper parameter into the configuration data passed to VPNC, allowing an attacker to execute arbitrary commands as root.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubylocallinux
https://www.exploit-db.com/exploits/45313
metasploit WORKING POC EXCELLENT
by Denis Andzakovic, bcoles · rubypoclinux
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/network_manager_vpnc_username_priv_esc.rb

References (9)

Scores

CVSS v3 7.8
EPSS 0.1468
EPSS Percentile 94.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (3)
debian/debian_linux 8.0
debian/debian_linux 9.0
gnome/network_manager_vpnc < 1.2.6
Published Jul 26, 2018
Tracked Since Feb 18, 2026