CVE-2026-44932: indirect remote shell command injection via unsanitized DHCP options in wicked

Synopsis

This is a remote shell command injection vulnerability in wicked, the SUSE network configuration service and DHCP client, affecting all versions before 0.6.79. An attacker operating a malicious DHCP server on the same network segment can send crafted DHCP reply options that wicked passes unsanitized to shell commands, requiring no authentication and no interaction from the victim. Successful exploitation gives the attacker code execution on the affected host with the privileges of the wicked process. A patched-image rebuild at version 0.6.79 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be present on the same adjacent network, LAN, or VPN segment as the target, positioned to serve DHCP replies to the victim host; remote internet-based exploitation is not possible directly.

• AuthenticationNot required

  No credentials or prior account access are needed; the attacker only needs to operate a DHCP server on the adjacent network.

• Victim interactionNot required

  No action by the victim is required; exploitation occurs automatically when the host requests or renews a DHCP lease.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable; no race conditions or unusual environmental factors need to be satisfied beyond controlling a DHCP server on the local segment.

Blast Radius

• The attacker executes arbitrary shell commands on the target host with the privileges of the wicked process.
• All data accessible to that process, including network credentials and configuration secrets stored on disk, is readable by the attacker.
• The attacker can modify network interface configuration, routing tables, and DNS resolver settings, redirecting or intercepting host traffic.
• The wicked service and dependent networking functionality can be crashed or disabled, cutting the host off from network connectivity.