CVE-2026-44932: Wicked DHCP Client RCE via Unsanitized String Injection

Technical summary

CVE-2026-44932 stems from insufficient input validation in wicked's DHCP client. The client fails to sanitize strings returned in DHCP replies before processing them, creating a classic command-injection vector (CWE-78). The attack surface is the network layer: any entity able to respond to DHCP requests or spoof DHCP replies can craft malicious payloads. The CVSS 3.1 score of 8.8 reflects high severity across confidentiality, integrity, and availability—an attacker gains unauthenticated remote code execution with only adjacent network access required.

Business impact

Successful exploitation enables complete system compromise: attackers can steal data, install persistence mechanisms, disrupt operations, or pivot to other networked assets. In enterprise environments where DHCP is centralized, a compromised rogue DHCP server or on-path attacker could affect multiple machines simultaneously. Organizations relying on wicked for network configuration are exposed to post-compromise lateral movement risks and credential harvesting.

Affected systems

The wicked DHCP client in versions prior to 0.6.79 is affected. Wicked is a network configuration daemon commonly used in Linux distributions, particularly SUSE-based systems, for dynamic IP assignment and network management. Check your distribution's package repositories and installed versions to determine exposure.

Exploitability

Exploitability is moderate in practice but structurally high: an attacker needs adjacent network access (AV:A) to send or intercept DHCP traffic, but requires no authentication, user interaction, or special privileges. In enterprise networks with rogue DHCP detection controls or where DHCP is strictly monitored and filtered, the window of opportunity narrows. In less-controlled environments or guest networks, this is readily exploitable.

Remediation

Update wicked to version 0.6.79 or later. This patch sanitizes DHCP reply strings before use. Organizations should prioritize this for systems with direct or unfiltered network exposure, especially those in untrusted network zones or handling sensitive workloads.

Patch guidance

Vendors and distributions will release patched wicked packages; coordinate updates through your distribution's security advisory channel. Verify the patch applies sanitization to all DHCP reply fields. Test in a non-production environment first, as DHCP client changes can affect network initialization. For systems unable to patch immediately, enforce network-layer segmentation (DHCP snooping, authorized server whitelisting) as a compensating control.

Detection guidance

Monitor for abnormal process spawning from wicked or dhcp-related daemons, especially commands that invoke shells or execute binaries. Log DHCP server responses and watch for unusually long or malformed option values. Intrusion detection systems should flag DHCP packets with suspicious payloads. Host-based monitoring of wicked process behavior and file-system changes during DHCP negotiation can reveal exploitation attempts.

Why prioritize this

This is a high-priority remote code execution flaw requiring minimal attacker capability (adjacent network access only, no authentication). The lack of KEV listing does not diminish urgency; the technical severity is unambiguous. Organizations with networked Linux systems—especially servers, IoT devices, or edge systems—should treat this as critical in their patching queue.

Risk score, explained

The CVSS 8.8 (HIGH) reflects the combination of unauthenticated network-adjacent RCE with full system compromise impact. The vector AV:A (Adjacent Network) and AC:L (Low Attack Complexity) indicate an attacker needs local network proximity but not elevated privilege. All three impact metrics (C:H, I:H, A:H) are maximal, reflecting unrestricted code execution capability.

Frequently asked questions