CVE-2026-44932: indirect remote shell command injection via unsanitized DHCP options in wicked
Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wicked dhcp clientto a version that resolves this vulnerability.Fixed in 0.6.79
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44932?
CVE-2026-44932 has a high severity rating of 8.8.
How do I fix CVE-2026-44932?
To fix CVE-2026-44932, upgrade to wicked version 0.6.79 or later.
What is the impact of CVE-2026-44932?
CVE-2026-44932 allows attackers to execute code on the local machine through indirect remote shell command injection.
Which software is affected by CVE-2026-44932?
CVE-2026-44932 affects the Suse Wicked DHCP client prior to version 0.6.79.
How can attackers exploit CVE-2026-44932?
Attackers can exploit CVE-2026-44932 by operating a malicious DHCP server that sends unsanitized strings in DHCP replies.