Incoming VPN network profile settings fail to process special characters safely, enabling command injection via malicious config files.