CVE-2026-42511 Overview
A critical command injection vulnerability exists in FreeBSD's dhclient implementation where the BOOTP file field is written to the lease file without properly escaping embedded double-quotes. This improper neutralization of special characters allows attackers to inject arbitrary dhclient.conf directives into the lease file. When the lease file is subsequently re-parsed by dhclient, such as after a system restart, an attacker-controlled field from the lease is passed to dhclient-script(8), which evaluates it as executable code.
A rogue DHCP server on the network may be able to execute arbitrary code as root on any system running the vulnerable dhclient implementation, leading to complete system compromise.
Critical Impact
A malicious DHCP server can achieve remote code execution with root privileges on FreeBSD systems running vulnerable versions of dhclient, requiring no user interaction beyond network connectivity.
Affected Products
- FreeBSD dhclient
- Systems using FreeBSD DHCP client implementation
Discovery Timeline
- April 30, 2026 - CVE CVE-2026-42511 published to NVD
- April 30, 2026 - Last updated in NVD database
Technical Details for CVE-2026-42511
Vulnerability Analysis
This vulnerability (CWE-149: Improper Neutralization of Quoting Syntax) stems from a failure to properly sanitize special characters in DHCP response data before writing it to persistent storage. The dhclient daemon receives DHCP/BOOTP responses from network servers and stores lease information in a lease file for persistence across system restarts. When processing the BOOTP file field, the implementation writes the value directly to the lease file without escaping embedded double-quote characters.
The exploitation mechanism leverages the trust relationship between the lease file and the dhclient-script(8) shell script. Upon system restart or lease renewal, dhclient re-parses the lease file and passes field values to the script, which evaluates them in a shell context. By embedding shell metacharacters within the BOOTP file field, an attacker can break out of the intended string context and inject arbitrary shell commands that execute with root privileges.
Root Cause
The root cause is improper neutralization of quoting syntax (CWE-149) in the BOOTP file field handling. The dhclient code fails to escape or sanitize double-quote characters before writing DHCP server-supplied data to the lease file. This allows attackers to inject malicious content that terminates the legitimate string context and introduces arbitrary dhclient.conf directives or shell commands.
Attack Vector
The attack requires a malicious DHCP server to be present on the same network segment as the victim system. When the victim's dhclient requests a DHCP lease, the rogue server responds with a crafted BOOTP file field containing embedded double-quotes and shell commands. The malicious payload is written to the lease file immediately. The injected code executes when dhclient restarts and re-parses the lease file, triggering command execution through dhclient-script(8) running as root.
The attack does not require any user interaction beyond the victim system being connected to a network where the attacker controls or can spoof a DHCP server.
Detection Methods for CVE-2026-42511
Indicators of Compromise
- Unusual double-quote characters or shell metacharacters in DHCP lease files (typically /var/db/dhclient.leases*)
- Unexpected commands or directives in lease file entries, particularly in the file field
- Suspicious processes spawned by dhclient-script or unusual child processes of the dhclient daemon
- Rogue DHCP servers on the network sending malformed BOOTP responses
Detection Strategies
- Monitor DHCP lease files for unexpected modifications or suspicious character sequences
- Implement network monitoring to detect unauthorized DHCP servers (DHCP snooping)
- Audit system logs for unexpected root process execution correlated with DHCP events
- Use file integrity monitoring on dhclient configuration and lease files
Monitoring Recommendations
- Enable enhanced logging for dhclient and dhclient-script operations
- Deploy network intrusion detection rules to identify malformed DHCP responses
- Monitor for processes spawned by dhclient-script that deviate from normal behavior
- Implement DHCP snooping on network switches to prevent rogue DHCP servers
How to Mitigate CVE-2026-42511
Immediate Actions Required
- Apply the FreeBSD security patch immediately on all affected systems
- Review existing DHCP lease files for signs of compromise before rebooting
- Consider using static IP configuration on critical systems until patching is complete
- Implement DHCP snooping on network infrastructure to mitigate rogue DHCP servers
Patch Information
FreeBSD has released a security advisory addressing this vulnerability. Refer to FreeBSD Security Advisory SA-26:12 for official patch information and detailed remediation guidance. The patch implements proper escaping of double-quote characters and other shell metacharacters when writing DHCP server-supplied data to lease files.
Workarounds
- Use static IP addressing instead of DHCP on critical systems where feasible
- Implement strict DHCP snooping and DHCP guard features on network switches
- Segment networks to limit exposure to potential rogue DHCP servers
- Remove write permissions on lease files after initial configuration where operationally feasible
- Consider using alternative DHCP clients that are not affected by this vulnerability
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
