NetSight
IP …
high7.8Public exploit code

CVE-2018-10900

Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to inject a Password helper parameter into the configuration data passed to VPNC, allowing an attacker to execute arbitrary commands as root.

Affected products

VendorProductAffected versions
GnomeNetwork Manager Vpnc
before 1.2.6
DebianDebian Linux
Versions 8.0, 9.0

Weakness classification

CWE-78

References