A flaw in the NetworkManager-sstp plugin allows a local unprivileged user to inject shell metacharacters into fields of a VPN connection profile, such as the CA certificate or proxy settings. These characters are then interpreted by the pppd daemon, which runs with root privileges, enabling the execution of arbitrary commands with elevated permissions when the malicious VPN connection is activated. This injection vector results in local privilege escalation to root and allows the attacker to compromise the entire system.

The vulnerability is present in the GNOME NetworkManager-sstp package. Specific version numbers are not disclosed, so all released iterations of this plugin remain potentially affected until patched.

The CVSS score of 7.8 indicates significant severity. The EPSS score is not available, but the vulnerability requires a local, unprivileged user to set up and activate a malicious VPN profile, which is a realistic threat in environments where users have sufficient rights to create VPN connections. The attacking path involves crafting a profile with special characters that are executed by pppd, leading to execution of arbitrary commands as root. While the vulnerability is not listed in the CISA KEV catalog, the attack vector and high severity warrant proactive mitigation.