Skip to main content

wicked CVE-2026-44932

| EUVDEUVD-2026-37127 HIGH
OS Command Injection (CWE-78)
2026-06-16 suse GHSA-hc32-vf4h-9cg4
Command Injection Wicked Red Hat
8.8
CVSS 3.1 · Vendor: suse
Share

Severity by source

Vendor (suse) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

Adjacent-network rogue DHCP server (AV:A, AC:L) needs no authentication or user interaction and injects shell commands executed by netconfig at high privilege, yielding full C/I/A impact.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
8.8 HIGH
qualitative

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Patch available
Jun 16, 2026 - 18:01 EUVD
Source Code Evidence Fetched
Jun 16, 2026 - 17:17 vuln.today
Analysis Generated
Jun 16, 2026 - 17:17 vuln.today

DescriptionCVE.org

Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.

AnalysisAI

Command injection in openSUSE/SUSE wicked DHCP client before 0.6.79 allows attackers operating a rogue DHCP server on the victim's local network segment to execute arbitrary commands by embedding single-quoted shell metacharacters in DHCP option strings, which are written unsanitized to /run/wicked/leaseinfo.* files and later consumed by netconfig. The CVSS 8.8 (AV:A) rating reflects adjacent-network exposure without authentication. No public exploit identified at time of analysis.

Technical ContextAI

wicked is the network configuration framework that ships as the default network manager on SUSE Linux Enterprise and openSUSE Leap-derived distributions, and includes its own DHCPv4/DHCPv6 client. The root cause is a CWE-78 OS Command Injection: when the DHCP client wrote acquired lease values into the leaseinfo dump used by wicked test dhcp4/wicked test dhcp6 and the /run/wicked/leaseinfo.* files, it emitted key='value' lines without escaping embedded single quotes. Downstream consumers - notably the netconfig shell pipeline that ingests those files - would then break out of the quoted value and interpret attacker-supplied bytes as shell tokens. The 0.6.79 fix escapes single quotes in leaseinfo dump output, tightens RFC4833 character validation for posix-tz-dbname and tz-string options, and discards other option values that still contain single quotes.

RemediationAI

Vendor-released patch: wicked 0.6.79 - upgrade via the SUSE SLE security updates published in June 2026 (lists.suse.com/pipermail/sle-security-updates/2026-June/026688.html through 026691.html) or by pulling the openSUSE/wicked version-0.6.79 tag. Because pre-0.6.78 wicked binaries can be embedded in initrd, regenerate the initrd (e.g. dracut -f or mkinitrd) after upgrading so early-boot DHCP also runs the fixed code. Where patching is delayed, restrict wicked clients to trusted Layer 2 segments and enable DHCP snooping plus port-security on access switches to block rogue DHCP servers; avoid running wicked test dhcp4/wicked test dhcp6 against untrusted networks; on hosts that do not require wicked, switching the network backend to NetworkManager removes exposure entirely at the cost of reconfiguring interface profiles.

More in Wicked

View all
CVE-2013-4413 MEDIUM POC
5.0 Mar 11

Directory traversal vulnerability in controller/concerns/render_redirect.rb in the Wicked gem before 1.0.1 for Ruby allo
CVE-2020-7217 HIGH
7.5 Feb 11

An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause
CVE-2020-7216 HIGH
7.5 Feb 05

An ni_dhcp4_parse_response memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial

CVE-2026-71402 MEDIUM
5.3 Aug 27

Out-of-bounds heap read in the DHCPv4 packet capture code of wicked (all versions through 0.6.80) allows an unauthentica
CVE-2026-71401 MEDIUM
5.3 Aug 27

Integer underflow in the wicked DHCPv4 packet capture daemon (wickedd-dhcp4) on SUSE Linux systems allows an unauthentic

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2024-9474 MEDIUM POC
6.9

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed

Share

CVE-2026-44932 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy