PT-2025-17472 · Ppp+1 · Ppp+1

Published 2025-04-22 · Updated 2025-05-09 · CVE-2024-58250

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ppp versions prior to 2.5.2

Description The passprompt plugin in pppd mishandles privileges. This issue affects versions of PPP prior to 2.5.2.

Recommendations For versions prior to 2.5.2, update to version 2.5.2 or later to resolve the issue. As a temporary workaround, consider disabling the passprompt plugin until a patch is available. Restrict access to the pppd component to minimize the risk of exploitation.

Fix

LPE

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

AZL-60894

AZL-61768

CVE-2024-58250

OESA-2025-1479

Affected Products

Debian

Ppp

References · 24

• https://osv.dev/vulnerability/AZL-61768 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-58250 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-58250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-58250 · Security Note
• https://osv.dev/vulnerability/AZL-60894 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1479 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-58250 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-58250 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-58250 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2024-58250 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-58250 · Security Note
• https://github.com/ppp-project/ppp/commit/0a66ad22e54c72690ec2a29a019767c55c5281fc · Note
• https://github.com/ppp-project/ppp/compare/v2.5.1...v2.5.2 · Note
• https://t.me/cvetracker/22082 · Telegram Post
• https://t.me/cvenotify/119278 · Telegram Post