A flaw in the nm-fortisslvpn-service causes it to mishandle carriage‑return/line‑feed characters embedded in VPN connection profile credentials. An unprivileged local user can craft a malicious profile that injects additional configuration directives, resulting in arbitrary code execution with root privileges when the profile is activated. This reflects a local privilege escalation vulnerability based on improper neutralization of special elements used in a command.

The vulnerability affects the GNOME NetworkManager‑fortisslvpn plugin, which is used to establish FortiSSLVPN connections on systems where the plugin is installed. The version information is not specified in the advisory, but the issue resides in the plugin package itself.

The CVSS score of 7.8 indicates a high severity of the flaw. Although the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the threat remains significant because the attack vector is local: an unprivileged user with access to the VPN profile files can create a malicious configuration and trigger it. Once the crafted profile is activated, the compromised nm‑fortisslvpn‑service runs with root privileges, enabling arbitrary code execution. The lack of a remote attack vector limits the scope to users who can modify VPN profiles, but the impact of root-level execution is severe.