{"id":"CVE-2018-10900","aliases":["DEBIAN-CVE-2018-10900","DLA-1454-1","DSA-4253-1","EUVD-2018-2957","GHSA-6cmp-3578-qc4p","SUSE-SU-2018:2297-1","UBUNTU-CVE-2018-10900","openSUSE-SU-2024:10604-1"],"status":"published","title":"Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a...","description":"Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to inject a Password helper parameter into the configuration data passed to VPNC, allowing an attacker to execute arbitrary commands as root.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.03957,"percentile":0.90506,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-78"],"published":"2018-07-23T00:00:00Z","modified":"2026-10-24T10:31:01Z","exploits":[{"source":"exploitdb","id":"EDB-45313","title":"Network Manager VPNC 1.2.6 - 'Username' Local Privilege Escalation (Metasploit)","type":"local","platform":"linux","date":"2018-08-31","verified":true,"url":"https://www.exploit-db.com/exploits/45313"},{"source":"metasploit","id":"exploit/linux/local/network_manager_vpnc_username_priv_esc","title":"Network Manager VPNC Username Privilege Escalation","type":"exploit","platform":"Linux","date":"2018-07-26","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/local/network_manager_vpnc_username_priv_esc"}],"fixes":[{"ecosystem":"Debian:12","package":"network-manager-vpnc","fixed_in":["1.2.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"network-manager-vpnc","fixed_in":["1.2.6-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"network-manager-vpnc","fixed_in":["0.9.10.0-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"network-manager-vpnc","fixed_in":["1.2.4-4+deb9u1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"NetworkManager-vpnc","fixed_in":["1.0.8-8.4.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"NetworkManager-vpnc","fixed_in":["1.0.8-8.4.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"network-manager-vpnc","fixed_in":["0.9.8.6-1ubuntu2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"network-manager-vpnc","fixed_in":["1.1.93-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"network-manager-vpnc","fixed_in":["1.2.4-6ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"network-manager-vpnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"network-manager-vpnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"network-manager-vpnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10.0-1+deb8u1"}]}],"versions":["0.9.10.0-1"]},{"source":"osv","ecosystem":"Debian:9","package":"network-manager-vpnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-4+deb9u1"}]}],"versions":["1.2.4-4"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"NetworkManager-vpnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-8.4.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"NetworkManager-vpnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-8.4.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"network-manager-vpnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8.6-1ubuntu2.1"}]}],"versions":["0.9.8.2-1ubuntu1","0.9.8.6-1ubuntu1","0.9.8.6-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"network-manager-vpnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.93-1ubuntu0.1"}]}],"versions":["0.9.10.0-1ubuntu1","1.0.8-1ubuntu1","1.1.93-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"network-manager-vpnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-6ubuntu0.1"}]}],"versions":["1.2.4-4","1.2.4-6"]}],"products":[{"vendor":"[unknown]","product":"networkmanager-vpnc"},{"vendor":"debian","product":"debian_linux"},{"vendor":"gnome","product":"network_manager_vpnc"}],"references":[{"url":"https://www.debian.org/security/2018/dsa-4253","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201808-03","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00048.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.exploit-db.com/exploits/45313/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://pulsesecurity.co.nz/advisories/NM-VPNC-Privesc","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://gitlab.gnome.org/GNOME/NetworkManager-vpnc/commit/07ac18a32b4","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","Vendor Advisory","fix"]},{"url":"https://bugzilla.novell.com/show_bug.cgi?id=1101147","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://download.gnome.org/sources/NetworkManager-vpnc/1.2/NetworkManager-vpnc-1.2.6.news","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","Vendor Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10900","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10900"},{"url":"https://github.com/advisories/GHSA-6cmp-3578-qc4p"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-10900","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182297-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1101147","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10900","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-10900","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2018/07/20","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-10900","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-10900","description":"Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to inject a Password helper parameter into the configuration data passed to VPNC, allowing an attacker to execute arbitrary commands as root.","status":"published","published":"2018-07-26T15:00:00Z","modified":"2024-08-05T07:54:36.169Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:01.952568Z"}],"euvd":[{"id":"EUVD-2018-2957","description":"Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to inject a Password helper parameter into the configuration data passed to VPNC, allowing an attacker to execute arbitrary commands as root.","status":"published","published":"2018-07-26T15:00:00Z","modified":"2024-08-05T07:54:36Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T02:39:57.009215Z"}],"ghsa":[{"id":"GHSA-6cmp-3578-qc4p","title":"Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a...","description":"Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to inject a Password helper parameter into the configuration data passed to VPNC, allowing an attacker to execute arbitrary commands as root.","status":"published","published":"2022-05-13T01:12:25Z","modified":"2023-02-01T05:03:58Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:50:07.322817Z"}],"nvd":[{"id":"CVE-2018-10900","description":"Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to inject a Password helper parameter into the configuration data passed to VPNC, allowing an attacker to execute arbitrary commands as root.","status":"published","published":"2018-07-26T15:29:00.45Z","modified":"2026-06-17T01:34:52.527Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:04:35.310988Z"}],"osv":[{"id":"CVE-2018-10900","description":"Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to inject a Password helper parameter into the configuration data passed to VPNC, allowing an attacker to execute arbitrary commands as root.","status":"published","published":"2018-07-26T15:29:00.45Z","modified":"2026-10-24T10:31:01.054112552Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"DEBIAN-CVE-2018-10900","description":"Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to inject a Password helper parameter into the configuration data passed to VPNC, allowing an attacker to execute arbitrary commands as root.","status":"published","published":"2018-07-26T15:29:00.45Z","modified":"2026-10-23T18:03:18.519203373Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"UBUNTU-CVE-2018-10900","description":"Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to inject a Password helper parameter into the configuration data passed to VPNC, allowing an attacker to execute arbitrary commands as root.","status":"published","published":"2018-07-26T15:29:00Z","modified":"2025-09-08T16:44:52Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"DLA-1454-1","title":"network-manager-vpnc - security update","status":"published","published":"2018-07-31T00:00:00Z","modified":"2026-03-09T01:01:54.814796Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4253-1","title":"network-manager-vpnc - security update","status":"published","published":"2018-07-23T00:00:00Z","modified":"2026-03-09T02:08:35.290099Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"openSUSE-SU-2024:10604-1","title":"NetworkManager-vpnc-1.2.6-4.1 on GA media","description":"These are all security issues fixed in the NetworkManager-vpnc-1.2.6-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:57.165403Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2018:2297-1","title":"Recommended update for NetworkManager-vpnc","description":"This update for NetworkManager-vpnc fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-10900: Check configurations that contain newline characters and invalidate them to avoid security attacks (bsc#1101147).\n","status":"published","published":"2018-08-10T09:39:10Z","modified":"2026-02-04T03:22:40.733745Z","updated_at":"2026-11-02T15:53:44.972817Z"}]}}