Skip to main content

wicked CVE-2026-44932

| EUVDEUVD-2026-37127 HIGH
OS Command Injection (CWE-78)
2026-06-16 suse GHSA-hc32-vf4h-9cg4
Command Injection Red Hat Suse Wicked
8.8
CVSS 3.1 · Vendor: suse
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Attach to victim's L2 segment
  2. Delivery
    Stand up rogue DHCPv4/DHCPv6 server
  3. Exploit
    Send reply with single-quoted shell payload in option string
  4. Install
    wicked writes unsanitized value to /run/wicked/leaseinfo.*
  5. C2
    netconfig parses broken key='value' line
  6. Execute
    Shell metacharacters execute as netconfig
  7. Impact
    Command execution on target host

Vulnerability Assessment

Weakness
CWE
CWE-78
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK

2 techniques across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Attacker must be on the same Layer 2 broadcast domain as the victim (AV:A) and able to win the DHCP race or be the sole responder, e.g. via a rogue DHCPv4/DHCPv6 server. The target must run wicked at a version <= 0.6.78 as its DHCP client and either (a) acquire/renew a lease such that wicked writes /run/wicked/leaseinfo.* consumed by netconfig, or (b) execute wicked test dhcp4 / wicked test dhcp6 against the attacker-controlled server. Limiting factors: no exposure across routed boundaries, hosts using NetworkManager instead of wicked are unaffected, DHCP snooping / port security on managed switches blocks the rogue-server prerequisite, and the injection requires the attacker-supplied option string to contain a single quote that wicked accepts (the 0.6.79 fix also tightens validation on posix-tz-dbname and tz-string options).
Impact

Signals are mostly consistent: CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N with C:H/I:H/A:H gives an 8.8 base, matching a root-level command-injection class flaw. No EPSS score, no CISA KEV listing, and no public exploit are referenced in the supplied data, so this is not currently a known mass-exploited issue, but the prerequisites are low: any attacker who can stand up a rogue DHCP server on the same broadcast domain (open Wi-Fi, conference/hotel LAN, compromised switch port, hostile VM neighbor) can target every wicked client that renews a lease. Real-world risk is concentrated in SUSE/openSUSE fleets that still run wicked rather than NetworkManager, especially mobile or branch hosts that attach to untrusted L2 networks; segments protected by DHCP snooping and managed switches are materially less exposed. The changelog also notes a need to regenerate initrd containing pre-0.6.78 wicked binaries, so a patched userspace alone may not fully remediate early-boot DHCP.
Exploit ScenarioDerived

An attacker joins the victim's broadcast domain - for example a conference Wi-Fi or a compromised VLAN - and runs a rogue DHCP server that responds with option values containing embedded single quotes followed by shell metacharacters. When a SUSE host running wicked < 0.6.79 acquires or renews its lease, wicked writes the unsanitized value into /run/wicked/leaseinfo.*, netconfig parses the broken key='value' line, and the attacker's payload is executed in the netconfig context on the target.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 16, 2026

Command injection in openSUSE/SUSE wicked DHCP client before 0.6.79 allows attackers operating a rogue DHCP server on the victim's local network segment to execute arbitrary commands by embedding single-quoted shell metacharacters in DHCP option strings, which are written unsanitized to /run/wicked/leaseinfo.* files and later consumed by netconfig. The CVSS 8.8 (AV:A) rating reflects adjacent-network exposure without authentication. No public exploit identified at time of analysis.

RemediationAI

Vendor-released patch: wicked 0.6.79 - upgrade via the SUSE SLE security updates published in June 2026 (lists.suse.com/pipermail/sle-security-updates/2026-June/026688.html through 026691.html) or by pulling the openSUSE/wicked version-0.6.79 tag. Because pre-0.6.78 wicked binaries can be embedded in initrd, regenerate the initrd (e.g. dracut -f or mkinitrd) after upgrading so early-boot DHCP also runs the fixed code. Where patching is delayed, restrict wicked clients to trusted Layer 2 segments and enable DHCP snooping plus port-security on access switches to block rogue DHCP servers; avoid running wicked test dhcp4/wicked test dhcp6 against untrusted networks; on hosts that do not require wicked, switching the network backend to NetworkManager removes exposure entirely at the cost of reconfiguring interface profiles.

Affected VersionsENISA

wicked 0 <0.6.79

Affected Packages

euvd wicked fix: 0.6.79

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

wicked is the network configuration framework that ships as the default network manager on SUSE Linux Enterprise and openSUSE Leap-derived distributions, and includes its own DHCPv4/DHCPv6 client. The root cause is a CWE-78 OS Command Injection: when the DHCP client wrote acquired lease values into the leaseinfo dump used by wicked test dhcp4/wicked test dhcp6 and the /run/wicked/leaseinfo.* files, it emitted key='value' lines without escaping embedded single quotes. Downstream consumers - notably the netconfig shell pipeline that ingests those files - would then break out of the quoted value and interpret attacker-supplied bytes as shell tokens. The 0.6.79 fix escapes single quotes in leaseinfo dump output, tightens RFC4833 character validation for posix-tz-dbname and tz-string options, and discards other option values that still contain single quotes.

Know when Wicked gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (suse) PRIMARY 8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 8.8 HIGH

Adjacent-network rogue DHCP server (AV:A, AC:L) needs no authentication or user interaction and injects shell commands executed by netconfig at high privilege, yielding full C/I/A impact.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
Patch available
Jun 16, 2026 - 18:01 EUVD

DescriptionCVE.org

Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.

Executive ViewAI

Why It Matters

openSUSE/SUSE wicked DHCP client versions before 0.6.79 contain a command injection vulnerability that allows attackers on the local network segment to execute arbitrary commands on affected systems. An attacker operating a rogue DHCP server can inject malicious shell commands through DHCP options, compromising system integrity and enabling lateral movement within networked infrastructure.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) DHCP snooping and Dynamic ARP Inspection on switches to prevent rogue DHCP servers; (2) restrict DHCP server communication to known infrastructure IP ranges via firewall rules; (3) disable DHCP and use static IP addressing on critical systems where operationally feasible; (4) implement network segmentation to limit lateral movement if compromise occurs; (5) monitor system logs and process execution for unauthorized command activity originating from DHCP configuration.

Threat Intelligence Overview

EPSS Score
0.5%
Top 62% exploitable
Social Media
2
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.5%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Controlled
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

More in Wicked

View all
CVE-2013-4413 MEDIUM POC
5.0 Mar 11

Directory traversal vulnerability in controller/concerns/render_redirect.rb in the Wicked gem before 1.0.1 for Ruby allo
CVE-2020-7217 HIGH
7.5 Feb 11

An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause
CVE-2020-7216 HIGH
7.5 Feb 05

An ni_dhcp4_parse_response memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial

CVE-2026-71401 MEDIUM
5.3 Aug 27

Integer underflow in the wicked DHCPv4 packet capture daemon (wickedd-dhcp4) on SUSE Linux systems allows an unauthentic
CVE-2026-71402 MEDIUM
5.3 Aug 27

Out-of-bounds heap read in the DHCPv4 packet capture code of wicked (all versions through 0.6.80) allows an unauthentica

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2020-9054 CRITICAL POC
9.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2016-3081 HIGH POC
8.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed

References

Advisories & patches
ADVISORY https://lists.suse.com/pipermail/sle-security-updates/2026-June/026688.html ADVISORY https://lists.suse.com/pipermail/sle-security-updates/2026-June/026689.html ADVISORY https://lists.suse.com/pipermail/sle-security-updates/2026-June/026690.html ADVISORY https://lists.suse.com/pipermail/sle-security-updates/2026-June/026691.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-44932 ADVISORY https://vuldb.com/vuln/371362 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2349/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2350/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2353/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2354/ REF https://bugzilla.suse.com/show_bug.cgi?id=1265221 REF https://github.com/openSUSE/wicked/releases/tag/version-0.6.79

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy