CVE-2026-44096: udhcpc Privilege Escalation Vulnerability

CVE-2026-44096 Overview

CVE-2026-44096 is a local privilege escalation vulnerability in udhcpc, the lightweight DHCP client shipped as part of BusyBox and used across embedded Linux systems. The flaw allows a local user account named charx-web to execute arbitrary commands as root through the DHCP client's script-handling logic. Successful exploitation grants full system compromise from an otherwise low-privileged service account. The issue is classified under CWE-78: OS Command Injection and was disclosed through a CERT-VDE Security Advisory.

Critical Impact
A local attacker with access to the charx-web account can escalate to root and take full control of affected devices.

Affected Products

Devices integrating udhcpc where the charx-web service account is present
Embedded Linux systems referenced in CERT-VDE advisory VDE-2026-008
Charging infrastructure and industrial devices using the affected firmware

Discovery Timeline

2026-07-30 - CVE-2026-44096 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-44096

Vulnerability Analysis

The vulnerability resides in how udhcpc processes DHCP response data before passing it to its configuration script. udhcpc invokes an external shell script whenever it receives a lease, renewal, or deconfiguration event. Environment variables and parameters derived from DHCP options are exposed to this script. When these values are not sanitized, an attacker who can influence the DHCP transaction or the script arguments can inject shell metacharacters that execute in the parent process context.

Because udhcpc typically runs with elevated privileges to configure network interfaces, injected commands execute as root. In the affected products, the local charx-web account has sufficient access to trigger this code path, converting a constrained web-service identity into unrestricted root execution.

Root Cause

The root cause is improper neutralization of special characters in OS commands [CWE-78]. Untrusted input reaches a shell interpreter without escaping or argument-vector separation, allowing metacharacters such as backticks, semicolons, and command substitutions to alter the executed command.

Attack Vector

Exploitation requires local access with the charx-web identity. The attacker crafts input that reaches the udhcpc script handler and includes shell metacharacters. When udhcpc dispatches the script, the injected payload is executed by root. No user interaction is required, and no additional privileges beyond charx-web are needed. Technical detail is available in the CERT-VDE Security Advisory.

Detection Methods for CVE-2026-44096

Indicators of Compromise

Unexpected child processes spawned by udhcpc or its default script (for example, /usr/share/udhcpc/default.script) with arguments containing shell metacharacters.
Root-owned processes originating from a session initially authenticated as charx-web.
Modifications to /etc/passwd, /etc/shadow, SSH authorized_keys, or cron directories shortly after DHCP lease events.

Detection Strategies

Audit process ancestry to flag any root process whose parent chain includes charx-web.
Monitor execution of udhcpc script hooks and alert on commands that were not shipped with the firmware image.
Enable Linux audit rules (auditd) on execve for the udhcpc binary and its script paths.

Monitoring Recommendations

Centralize authentication and process telemetry from embedded devices for correlation across the fleet.
Baseline the normal command set executed by udhcpc scripts and alert on deviations.
Track DHCP renewal frequency and script invocations to detect abnormal spikes tied to exploitation attempts.

How to Mitigate CVE-2026-44096

Immediate Actions Required

Apply the vendor firmware update referenced in CERT-VDE advisory VDE-2026-008 as soon as it becomes available for your device model.
Restrict network and shell access to the charx-web account until patching is complete.
Inventory affected devices and prioritize those exposed to shared or untrusted networks.

Patch Information

Refer to the CERT-VDE Security Advisory for vendor-supplied firmware versions that remediate CVE-2026-44096. Verify device firmware after update and confirm the fixed version is present before returning devices to production.

Workarounds

Disable or lock the charx-web account where the associated web functionality is not required.
Restrict the DHCP client to trusted network segments and enforce static addressing where feasible.
Apply file-system permissions that prevent non-root users from modifying udhcpc script hooks.

bash

# Configuration example: lock the charx-web account and restrict script permissions
sudo passwd -l charx-web
sudo chown root:root /usr/share/udhcpc/default.script
sudo chmod 700 /usr/share/udhcpc/default.script