Description
Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to inject a Password helper parameter into the configuration data passed to VPNC, allowing an attacker to execute arbitrary commands as root.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | networkmanager-vpnc | NetworkManager-vpnc 1.2.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | network-manager-vpnc | 1.2.6-1 | — |
| Debian 12 | network-manager-vpnc | 1.2.6-1 | — |
| Debian 9 | network-manager-vpnc | 1.2.4-4+deb9u1 | DSA-4253-1 |
| Debian 8 | network-manager-vpnc | 0.9.10.0-1+deb8u1 | DLA-1454-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | network-manager-vpnc | 1.2.4-6ubuntu0.1 | — |
| Ubuntu 16.04 LTS | network-manager-vpnc | 1.1.93-1ubuntu0.1 | — |
| Ubuntu 14.04 LTS | network-manager-vpnc | 0.9.8.6-1ubuntu2.1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | NetworkManager-vpnc | 1.0.8-8.4.2 | SUSE-SU-2018:2297-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Network Manager VPNC Username Privilege Escalation
exploit/linux/local/network_manager_vpnc_username_priv_esc
Exploit-DB 1
- Network Manager VPNC 1.2.6 - 'Username' Local Privilege Escalation (Metasploit) EDB-45313 · local · Aug 31, 2018 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- DSA-4253-1 network-manager-vpnc - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1454-1 network-manager-vpnc - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2018:2297-1 Recommended update for NetworkManager-vpnc SUSE / openSUSE Security Updates · Feb 4, 2026
References
- DSA-4253 vendor-advisory
- GLSA-201808-03 vendor-advisory
- [debian-lts-announce] 20180731 [SECURITY] [DLA 1454-1] network-manager-vpnc security update mailing-list
- 45313 exploit
- https://pulsesecurity.co.nz/advisories/NM-VPNC-Privesc
- https://gitlab.gnome.org/GNOME/NetworkManager-vpnc/commit/07ac18a32b4
- https://bugzilla.novell.com/show_bug.cgi?id=1101147
- https://download.gnome.org/sources/NetworkManager-vpnc/1.2/NetworkManager-vpnc-1.2.6.news
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10900