---
id: CVE-2026-93337
title: >-
  NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper
  input validation vulnerability that allows local users with VPN connection
  creation permissions to inject arbitrary pppd directives by supplying mru or
  mtu propert…
summary: >-
  NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper
  input validation vulnerability that allows local users with VPN connection
  creation permissions to inject arbitrary pppd directives by supplying mru or
  mtu propert…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-88
vendor: nm-l2tp
product: NetworkManager-l2tp
affected:
  - NetworkManager-l2tp <= 1.52.4
published: '2026-09-17'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T19:19:44.740'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93337'
references:
  - url: >-
      https://github.com/nm-l2tp/NetworkManager-l2tp/commit/64879ce0ad866f7c9a45babe4d95731a916ea00f
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/nm-l2tp/NetworkManager-l2tp/security/advisories/GHSA-rp84-8h2r-5xc3
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/networkmanager-l2tp-privilege-escalation-via-pppd-plugin-injection
    label: disclosure@vulncheck.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93337.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-93337'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-93337'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-21T16:42:37.537113Z'
epss: 0.00198
epssPercentile: 0.08415
ingestedAt: '2026-09-17T19:26:25.323Z'
---

## Overview

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a valid integer. Attackers can exploit the verbatim write of unvalidated strings into the pppd options file via write_config_option() to inject the plugin directive, causing the privileged pppd process to load an attacker-controlled shared object and achieve arbitrary code execution as root.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · updated 2026-09-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93337.json)