CVE-2024-58250

The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.

9.3 CriticalFix available

The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.24%Up 0.2 points since Apr 22, 2025

What each source reports

CVE List Score used 9.3

The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.

Record: CVE-2024-58250
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-426
Updated: 2026-11-02

EUVDEUVD-2025-12338 9.3

The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.

Record: EUVD-2025-12338
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-v77v-qh6r-74qh 9.3

The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.

The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.

Record: GHSA-v77v-qh6r-74qh
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-426
Updated: 2026-11-02

NVD 9.3

The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.

Record: CVE-2024-58250
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-426
Updated: 2026-11-02

OSVBELL-CVE-2024-58250 9.3

Record: BELL-CVE-2024-58250
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSV 9.3

The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.

Record: CVE-2024-58250
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-426
Updated: 2026-11-02

Show 5 moreShow less

OSVDEBIAN-CVE-2024-58250 9.3

The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.

Record: DEBIAN-CVE-2024-58250
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-1479 9.3

ppp security update

The Point-to-Point Protocol (PPP) provides a standard way to establish a network connection over a serial link. At present, this package supports IP and IPV6 and the protocols layered above them, such as TCP and UDP. The Linux port of this package also has support for IPX.

Security Fix(es):

The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.(CVE-2024-58250)

Record: OESA-2025-1479
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-58250 9.3

The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.

Record: UBUNTU-CVE-2024-58250
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVAZL-60894 No score

CVE-2024-58250 affecting package ppp 2.4.7-36

The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.

Record: AZL-60894
Updated: 2026-11-02

OSVAZL-61768 No score

CVE-2024-58250 affecting package ppp 2.5.0-1

The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.

Record: AZL-61768
Updated: 2026-11-05

Affected products

samba ppp

Affected packages

Affected packages
Package	Affected	Fixed
`ppp` Azure Linux:2	through 2.4.7-36	None known
`ppp` Azure Linux:3	through 2.5.0-1	None known
`ppp` Alpaquita:stream	2.5.0-r2 up to 2.5.2-r0	2.5.2-r0
`ppp` Debian:12	All versions, plus listed versions 2.4.9-1+1.12.5.0-1+12.5.0-1+22.5.1-1+12.5.1-1+1~exp1 Show 5 moreShow less 2.5.2-1+12.5.2-1+1.12.5.2-1+1.22.5.2-1+1~exp12.5.2-1+2	None known
`ppp` Debian:13	before 2.5.2-1+1	2.5.2-1+1
`ppp` Debian:14	before 2.5.2-1+1	2.5.2-1+1
`ppp` openEuler:24.03-LTS-SP1	before 2.5.0-5.oe2403sp1	2.5.0-5.oe2403sp1
`ppp` openEuler:20.03-LTS-SP4	before 2.4.8-8.oe2003sp4	2.4.8-8.oe2003sp4
`ppp` openEuler:22.03-LTS-SP3	before 2.4.9-8.oe2203sp3	2.4.9-8.oe2203sp3
`ppp` openEuler:22.03-LTS-SP4	before 2.4.9-8.oe2203sp4	2.4.9-8.oe2203sp4

Show 7 moreShow less

Affected packages
Package	Affected	Fixed
`ppp` openEuler:24.03-LTS	before 2.5.0-5.oe2403	2.5.0-5.oe2403
`ppp` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 2.4.5-5.1ubuntu22.4.5-5.1ubuntu2.12.4.5-5.1ubuntu2.22.4.5-5.1ubuntu2.32.4.5-5.1ubuntu2.3+esm12.4.5-5.1ubuntu2.3+esm2	None known
`ppp` Ubuntu:16.04:LTS	All versions, plus listed versions 2.4.6-3.1ubuntu12.4.7-1+1ubuntu12.4.7-1+2ubuntu12.4.7-1+2ubuntu1.16.04.12.4.7-1+2ubuntu1.16.04.22.4.7-1+2ubuntu1.16.04.3	None known
`ppp` Ubuntu:18.04:LTS	All versions, plus listed versions 2.4.7-1+2ubuntu12.4.7-1+4ubuntu12.4.7-1+4ubuntu32.4.7-2+1ubuntu12.4.7-2+2ubuntu12.4.7-2+2ubuntu1.12.4.7-2+2ubuntu1.22.4.7-2+2ubuntu1.3	None known
`ppp` Ubuntu:20.04:LTS	All versions, plus listed versions 2.4.7-2+4.1ubuntu42.4.7-2+4.1ubuntu52.4.7-2+4.1ubuntu5.1	None known
`ppp` Ubuntu:22.04:LTS	All versions, plus listed versions 2.4.9-1+1ubuntu12.4.9-1+1ubuntu22.4.9-1+1ubuntu3	None known
`ppp` Ubuntu:24.04:LTS	All versions, plus listed versions 2.4.9-1+1.1ubuntu12.4.9-1+1.1ubuntu22.4.9-1+1.1ubuntu4	None known

History

History
Recorded	Changed	Sources
Nov 5, 2026	facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-58250 is a critical vulnerability (CVSS 9.3) in Samba Ppp, published April 22, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 14th percentile. Fixed in ppp 2.5.2-r0.

References

Show 5 moreShow less