Description
Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.
Published: 2026-06-16
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability stems from passing unsanitized strings from DHCP replies directly to the wicked dhcp client. It enables arbitrary code execution on the local host, effectively giving an attacker remote command execution capabilities. This weakness involves both operating system command injection (CWE‑78) and improper control of generation of code (CWE‑94).

Affected Systems

Vendor SUSE offers the wicked daemon. Any instance of wicked prior to version 0.6.79 is affected. Users running versions before the 0.6.79 release must update.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity. The EPSS score of less than 1% suggests exploitation is considered unlikely at present, but the vulnerability can be exploited over the network by an attacker controlling a DHCP server and is not listed in CISA KEV. The attack path involves a malicious DHCP server supplying crafted options that are executed by the local wicked client.

Generated by OpenCVE AI on June 23, 2026 at 13:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade wicked to version 0.6.79 or later, which sanitizes DHCP options before execution.
  • If an immediate upgrade is not possible, temporarily stop the wicked DHCP client service until the patch is applied.
  • Restrict DHCP traffic to trusted interfaces or networks by configuring firewall rules or VLAN segmentation to limit exposure to malicious DHCP servers.

Generated by OpenCVE AI on June 23, 2026 at 13:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 26 Jun 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Suse
Suse wicked
Vendors & Products Suse
Suse wicked

Tue, 23 Jun 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-94
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 16 Jun 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 16 Jun 2026 16:45:00 +0000

Type Values Removed Values Added
Description Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.
Title indirect remote shell command injection via unsanitized DHCP options in wicked
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Suse Wicked
cve-icon MITRE

Status: PUBLISHED

Assigner: suse

Published:

Updated: 2026-06-18T03:55:34.354Z

Reserved: 2026-05-08T12:29:48.966Z

Link: CVE-2026-44932

cve-icon Vulnrichment

Updated: 2026-06-16T17:53:09.439Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-06-16T17:16:40.953

Modified: 2026-06-16T17:37:16.933

Link: CVE-2026-44932

cve-icon Redhat

Severity : Important

Publid Date: 2026-06-16T15:26:51Z

Links: CVE-2026-44932 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-26T09:45:13Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')