The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacket_buf without checking the available space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to a server which requests PEAP authentication can be induced to corrupt global static data following the outpacket_buf array, most likely causing incorrect behavior or a crash.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4808 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4808-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                  Andreans Henriksson     October 01, 2026                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : network-manager-l2tp     Version        : 1.20.8-1+deb12u1     CVE ID         : CVE-2026-19624 CVE-2026-75131 CVE-2026-75883 CVE-2026-93337

    Andres Berbescu discovered two vulnerabilities in the L2TP connection     plugin for Network Manager which allowed a local user with permissions     to create/activate personal VPN connections to escalate their privileges     to root.

    For Debian 12 bookworm, these problems have been fixed in version     1.20.8-1+deb12u1.

    We recommend that you upgrade your network-manager-l2tp packages.

    For the detailed security status of network-manager-l2tp please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/network-manager-l2tp

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6498 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6498-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     September 14, 2026                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : network-manager-l2tp     CVE ID         : CVE-2026-19624 CVE-2026-75131 CVE-2026-75883

    Andres Berbescu discovered two vulnerabilities in the L2TP connection     plugin for Network Manager which allowed a local user with permissions     to create/activate personal VPN connections to escalate their privileges     to root.

    For the stable distribution (trixie), these problems have been fixed in     version 1.20.20-2+deb13u1.

    We recommend that you upgrade your network-manager-l2tp packages.

    For the detailed security status of network-manager-l2tp please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/network-manager-l2tp

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS     record of up to 16384 bytes into the fixed global buffer outpacket_buf without checking the available     space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to a server     which requests PEAP authentication can be induced to corrupt global static data following the     outpacket_buf array, most likely causing incorrect behavior or a crash. (CVE-2026-75883)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
362456	Debian dla-4808 : network-manager-l2tp - security update	Nessus	Debian Local Security Checks	Local	high
345722	Debian dsa-6498 : network-manager-l2tp - security update	Nessus	Debian Local Security Checks	Local	high
345670	Linux Distros Unpatched Vulnerability : CVE-2026-75883	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-75883

medium

Tenable Plugins

high

high

medium