CVE-2026-44932: Wicked DHCP Client RCE Vulnerability

CVE-2026-44932 Overview

CVE-2026-44932 affects the wicked network configuration framework used in SUSE and openSUSE Linux distributions. The flaw exists in the wicked DHCP client in versions before 0.6.79. The client passes unsanitized strings received in Dynamic Host Configuration Protocol (DHCP) replies to downstream processing, enabling OS command injection [CWE-78]. An attacker operating a malicious DHCP server on the same broadcast domain can craft DHCP responses that execute arbitrary code on the local machine. The vulnerability requires no authentication and no user interaction, and impacts confidentiality, integrity, and availability.

Critical Impact
A rogue DHCP server on an adjacent network can execute arbitrary code on any Linux host running a vulnerable wicked DHCP client, with full impact to confidentiality, integrity, and availability.

Affected Products

openSUSE wicked versions prior to 0.6.79
SUSE Linux Enterprise distributions shipping vulnerable wicked packages
Any Linux system using wicked as the DHCP client

Discovery Timeline

2026-06-16 - CVE-2026-44932 published to NVD
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-44932

Vulnerability Analysis

The wicked framework manages network interface configuration on SUSE-based Linux systems. Its DHCP client parses option fields returned by a DHCP server, including strings such as hostname, domain name, and other text-valued options. The vulnerable code paths pass these strings to downstream handlers without sanitizing shell metacharacters or quoting them safely. Because the affected code is reachable via DHCP reply parsing, exploitation requires only that a victim host accept a DHCP lease from an attacker-controlled server on the adjacent network segment. Successful exploitation runs attacker-supplied commands in the security context of the wicked DHCP client, typically root.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. String fields from DHCP responses flow into command construction or hook script invocation without validation against an allowlist or proper escaping. Releases up to and including the version before 0.6.79 ship the unsanitized parsing logic.

Attack Vector

The attack vector is adjacent network. An attacker must place a malicious DHCP server on the same Layer 2 segment as the victim host, then race or replace the legitimate DHCP server in responding to client DHCPDISCOVER or DHCPREQUEST messages. By embedding shell metacharacters in a string-valued DHCP option, the attacker triggers command execution when wicked processes the lease. See the SUSE Bug Report #1265221 and the openSUSE Wicked Release v0.6.79 for upstream technical details.

No verified public proof-of-concept code is available at the time of writing. The vulnerability mechanism is described in the upstream advisory: malicious DHCP option strings flow into command execution paths invoked by the wicked DHCP client during lease processing.

Detection Methods for CVE-2026-44932

Indicators of Compromise

Unexpected child processes spawned by wickedd-dhcp4 or wickedd-dhcp6 daemons, especially shells such as /bin/sh, /bin/bash, or interpreters like python and perl
DHCP lease files in /var/lib/wicked/ containing shell metacharacters such as backticks, $(), semicolons, or newlines in option fields
DHCP OFFER or ACK packets containing oversized or metacharacter-laden hostname, domain, or vendor-class option values
Outbound network connections originating from the wicked DHCP client process to unexpected destinations

Detection Strategies

Monitor process ancestry where wickedd-dhcp4 or wickedd-dhcp6 is the parent of shells, scripting interpreters, or networking tools
Inspect DHCP traffic on local segments for malformed option strings using tcpdump or a network sensor
Audit installed wicked package versions across the fleet and flag any version below 0.6.79
Correlate DHCP lease renewal events with new process creation on the same host within a short time window

Monitoring Recommendations

Enable Linux auditd rules on execve syscalls with parent process names matching wickedd*
Forward DHCP server logs and switch port DHCP snooping events to a central log platform for review
Alert on changes to network configuration scripts under /etc/wicked/ and /etc/sysconfig/network/
Track package inventory to confirm wicked is patched to 0.6.79 or later across all SUSE and openSUSE hosts

How to Mitigate CVE-2026-44932

Immediate Actions Required

Update wicked to version 0.6.79 or later using the vendor security updates referenced below
Apply the official SUSE patches listed in SUSE Security Update #026688, #026689, #026690, and #026691
Restart wickedd services after patching to load the fixed binaries
Audit all network segments where SUSE or openSUSE hosts use DHCP for unauthorized DHCP servers

Patch Information

The upstream fix is included in the openSUSE Wicked Release v0.6.79. SUSE has published binary updates for supported Linux Enterprise releases via the security update mailing list. Verify the installed version with wicked --version after applying the update.

Workarounds

Enable DHCP snooping on managed switches to block DHCP server responses from untrusted ports
Restrict access to wired and wireless networks where SUSE hosts obtain DHCP leases, using 802.1X or MAC-based access control
Configure static IP addressing on critical hosts until patching is complete, removing reliance on the vulnerable DHCP client
Disable wicked DHCP processing on hosts that do not require dynamic addressing

bash

# Configuration example: verify and update wicked on SUSE/openSUSE
zypper refresh
zypper info wicked | grep -i version
zypper update wicked
systemctl restart wickedd.service wickedd-dhcp4.service wickedd-dhcp6.service
wicked --version