CVE-2025-9615 hardened private-connection FILE certificate and key paths in NetworkManager, but the directory-valued properties 802-1x.ca-path and phase2-ca-path were not included in that guard. An unprivileged user can set these properties on a private connection profile, and NetworkManager (running as root) passes ca_path/ca_path2 to wpa_supplicant (also running as root) without the private_user ownership check applied to the FILE-typed CA cert/key properties.

By pointing ca-path/phase2-ca-path at an attacker-controlled CA directory, an unprivileged local user can subvert WPA-Enterprise (802.1X) server certificate validation. On an existing corporate/eduroam profile, this lets an evil-twin AP pass certificate validation, allowing capture of the user's EAP credentials (e.g. MSCHAPv2 hash via hostapd-wpe in the reporter's PoC). The control case with /etc/ssl/certs was correctly rejected.

Scope: WPA-Enterprise (802.1X) networks only; not applicable to open or PSK networks. Requires an active local seat with the (typically passwordless) settings.modify.own permission; not exploitable via an inactive SSH session alone.

Reported by BreachX Zero Day Labs (BreachPoint Pvt Ltd, India) as part of a CERT-In coordinated disclosure also sent to Ubuntu Security and Debian Security, and copied to CERT-In (vdisclose.in). Internal reporter ID: CERT-IN-06-NM-CA-PATH.

Affected versions per reporter: Ubuntu NM 1.54.3, Kali 1.54.0, upstream tip 1.59.2-dev (commit 1947869) at time of report.

Reference: PSIRTSUPT-20440.