{"id":"CVE-2024-58250","aliases":["AZL-60894","AZL-61768","BELL-CVE-2024-58250","DEBIAN-CVE-2024-58250","EUVD-2025-12338","GHSA-v77v-qh6r-74qh","OESA-2025-1479","UBUNTU-CVE-2024-58250"],"status":"published","title":"The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.","description":"The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.","severity":{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00236,"percentile":0.14671,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-426"],"published":"2025-04-22T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpaquita:stream","package":"ppp","fixed_in":["2.5.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ppp","fixed_in":["2.5.2-1+1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ppp","fixed_in":["2.5.2-1+1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"ppp","fixed_in":["2.5.0-5.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"ppp","fixed_in":["2.4.8-8.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"ppp","fixed_in":["2.4.9-8.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"ppp","fixed_in":["2.4.9-8.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"ppp","fixed_in":["2.5.0-5.oe2403"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.4.7-36"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.5.0-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0-r2"},{"fixed":"2.5.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.9-1+1.1","2.5.0-1+1","2.5.0-1+2","2.5.1-1+1","2.5.1-1+1~exp1","2.5.2-1+1","2.5.2-1+1.1","2.5.2-1+1.2","2.5.2-1+1~exp1","2.5.2-1+2"]},{"source":"osv","ecosystem":"Debian:13","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-1+1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-1+1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-5.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8-8.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-8.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-8.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-5.oe2403"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.5-5.1ubuntu2","2.4.5-5.1ubuntu2.1","2.4.5-5.1ubuntu2.2","2.4.5-5.1ubuntu2.3","2.4.5-5.1ubuntu2.3+esm1","2.4.5-5.1ubuntu2.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.6-3.1ubuntu1","2.4.7-1+1ubuntu1","2.4.7-1+2ubuntu1","2.4.7-1+2ubuntu1.16.04.1","2.4.7-1+2ubuntu1.16.04.2","2.4.7-1+2ubuntu1.16.04.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-1+2ubuntu1","2.4.7-1+4ubuntu1","2.4.7-1+4ubuntu3","2.4.7-2+1ubuntu1","2.4.7-2+2ubuntu1","2.4.7-2+2ubuntu1.1","2.4.7-2+2ubuntu1.2","2.4.7-2+2ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-2+4.1ubuntu4","2.4.7-2+4.1ubuntu5","2.4.7-2+4.1ubuntu5.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.9-1+1ubuntu1","2.4.9-1+1ubuntu2","2.4.9-1+1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.9-1+1.1ubuntu1","2.4.9-1+1.1ubuntu2","2.4.9-1+1.1ubuntu4"]}],"products":[{"vendor":"samba","product":"ppp"}],"references":[{"url":"https://github.com/ppp-project/ppp/commit/0a66ad22e54c72690ec2a29a019767c55c5281fc","tags":["fix"]},{"url":"https://github.com/ppp-project/ppp/compare/v2.5.1...v2.5.2","tags":["web","report"]},{"url":"https://ppp.samba.org","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58250","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-v77v-qh6r-74qh"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-58250","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58250.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-58250","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1479","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-58250","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-58250","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-58250","description":"The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.","status":"published","published":"2025-04-22T00:00:00Z","modified":"2025-04-22T02:08:05.615Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-426"],"updated_at":"2026-11-02T14:34:08.843708Z"}],"euvd":[{"id":"EUVD-2025-12338","description":"The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.","status":"published","published":"2025-04-22T00:00:00Z","modified":"2025-04-22T02:08:05Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:52:17.705566Z"}],"ghsa":[{"id":"GHSA-v77v-qh6r-74qh","title":"The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.","description":"The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.","status":"published","published":"2025-04-22T03:30:25Z","modified":"2025-04-22T03:30:31Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-426"],"updated_at":"2026-11-02T15:01:59.076415Z"}],"nvd":[{"id":"CVE-2024-58250","description":"The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.","status":"published","published":"2025-04-22T01:15:17.27Z","modified":"2026-06-17T08:14:42.733Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-426"],"updated_at":"2026-11-02T14:10:46.40251Z"}],"osv":[{"id":"BELL-CVE-2024-58250","status":"published","published":"2025-04-24T05:59:42.415774Z","modified":"2026-08-31T07:15:06.000534166Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"CVE-2024-58250","description":"The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.","status":"published","published":"2025-04-22T00:00:00Z","modified":"2026-10-28T10:51:25.341586761Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-426"],"updated_at":"2026-11-02T15:44:45.107804Z"},{"id":"DEBIAN-CVE-2024-58250","description":"The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.","status":"published","published":"2025-04-22T01:15:17.27Z","modified":"2026-11-02T12:03:11.683034427Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:44.747956Z"},{"id":"OESA-2025-1479","title":"ppp security update","description":"The Point-to-Point Protocol (PPP) provides a standard way to establish a network connection over a serial link.  At present, this package supports IP and IPV6 and the protocols layered above them, such as TCP and UDP.  The Linux port of this package also has support for IPX.\r\n\r\nSecurity Fix(es):\n\nThe passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.(CVE-2024-58250)","status":"published","published":"2025-05-09T11:08:34Z","modified":"2026-08-18T01:17:52.24867184Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"UBUNTU-CVE-2024-58250","description":"The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.","status":"published","published":"2025-04-22T01:15:00Z","modified":"2026-04-22T15:25:16.417513Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"AZL-60894","title":"CVE-2024-58250 affecting package ppp 2.4.7-36","description":"The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.","status":"published","published":"2025-04-22T01:15:17Z","modified":"2026-04-21T04:37:28.350009Z","updated_at":"2026-11-02T15:28:07.517393Z"},{"id":"AZL-61768","title":"CVE-2024-58250 affecting package ppp 2.5.0-1","description":"The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.","status":"published","published":"2025-04-22T01:15:17Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:21.518778Z"}]}}