CVE-2025-9615
Low · 3.3CVSS
3.3
EPSS
0.2%
Published
Jan 26, 2026
CISA due date
—
The record
A flaw was found in NetworkManager. The NetworkManager package allows access to files that may belong to other users. NetworkManager allows non-root users to configure the system's network. The daemon runs with root privileges and can access files owned by users different from the one who added the connection.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | NetworkManager | 0 | 1.44.2-150600.3.7.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | NetworkManager | 0 | 1.44.2-150600.3.7.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP7 | NetworkManager | 0 | 1.44.2-150600.3.7.1 |
| openSUSE:Leap 15.6 | NetworkManager | 0 | 1.44.2-150600.3.7.1 |
| openSUSE:Leap 16.0 | NetworkManager | 0 | 1.52.0-160000.4.1 |
| openSUSE:Leap 16.0 | strongswan | 0 | 6.0.4-160000.1.1 |
| openSUSE:Tumbleweed | NetworkManager-l2tp | 0 | 1.52.0-1.1 |
| openSUSE:Tumbleweed | NetworkManager-openvpn | 0 | 1.12.5-1.1 |
| openSUSE:Tumbleweed | NetworkManager-strongswan | 0 | 1.6.4-1.1 |
| openSUSE:Tumbleweed | strongswan | 0 | 6.0.4-1.1 |
Related vulnerabilities
- CVE-2026-25075 strongSwan versions 4.5.0 prior to 6.0.5 contain an integer underflow vulnerability in… Also affects strongswan
- CVE-2025-62291 In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious… Also affects strongswan
- CVE-2017-11185 The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of… Also affects strongswan
- CVE-2017-9022 The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys… Also affects strongswan
- CVE-2015-8023 The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in… Also affects strongswan
- CVE-2015-4171 strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when… Also affects strongswan
- CVE-2014-9221 strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of… Also affects strongswan
- CVE-2026-61709 OpenFGA is an authorization and permission engine built for developers. CWE-281