Quick Look: CVE-2026-44932 — Indirect Shell Command Injection via SUSE Wicked DHCP Client

Introduction

A rogue DHCP server on your local network segment could get root-level code execution on any SUSE Linux Enterprise or openSUSE host running the wicked network configuration framework, just by answering a routine DHCP request with a crafted option value. CVE-2026-44932 exposes a classic but often-overlooked attack surface, the trust boundary between network protocol data and shell evaluation contexts. This time it is in the DHCP client that ships as the default networking stack across SUSE's enterprise product line.

Wicked, SUSE's default network configuration framework, replaced the older sysconfig package for managing network interfaces on SUSE Linux Enterprise Server, SUSE Linux Enterprise Desktop, SLE Micro, and openSUSE distributions. The openSUSE project develops it on GitHub, and it is present on virtually every SUSE-based system that uses DHCP for network configuration. The vulnerability has a CVSS 3.1 score of 8.8 (High) and is classified as CWE-78 (OS Command Injection).

Technical Information

Root Cause: Unsanitized DHCP Option Strings in Leaseinfo Files

The vulnerability is in the function __ni_leaseinfo_print_string() in wicked's src/leaseinfo.c. This function writes DHCP option values received from a DHCP server into files at /run/wicked/leaseinfo.*, using a shell-compatible KEY='value' format. Before version 0.6.79, the function used a naive pattern:

fprintf(out, "%s='%s'\n", ...);

This wraps each value in single quotes without validating or escaping shell metacharacters. A single quote embedded in a DHCP server's response terminates the quoting context, and the server can then append arbitrary content. Backticks, command separators (;), subshell invocations ($()), and other shell special characters also pass through unmodified.

DHCP options such as POSIXTZSTRING (option 100, per RFC 4833) and POSIXTZDBNAME (option 101) are string-valued fields that an attacker can fill with arbitrary content. When a malicious DHCP server puts shell metacharacters in these fields, the leaseinfo file ends up with syntactically broken shell variable assignments. When a shell script sources that file, the injected commands run.

The Exploitation Chain

The attack proceeds through four stages:

Stage 1: Attacker Positioning. The attacker must be on the local or adjacent network, either running a malicious DHCP server or sending spoofed DHCP responses. The CVSS vector (AV:A/AC:L/PR:N/UI:N) confirms that the attack needs no privileges, authentication, or user interaction.

Stage 2: Malicious DHCP Response. When the wicked DHCP client (dhcp4 or dhcp6) requests network configuration, the attacker's server answers with DHCP options that contain shell metacharacters. A single quote in a timezone string value, for example, breaks out of the enclosing quotes in the leaseinfo file.

Stage 3: Unsanitized File Write. The __ni_leaseinfo_print_string() function writes these values verbatim into /run/wicked/leaseinfo.* files. The file now contains a line where attacker-controlled content has escaped the quoting context and can include arbitrary shell commands.

Stage 4: Indirect Execution. Wicked itself does not source these leaseinfo files as shell scripts, but third-party scripts that do source them will execute the injected commands. The SUSE Bugzilla entry (bsc#1265221) names dracut's network-legacy module as one such consumer, in particular the ifup.sh script used in SLE 15 SP7, which inadvertently evaluates the unsanitized input. Because dracut runs during early boot and initrd initialization, the injected commands execute with root privileges.

The "Indirect" Nature of the Vulnerability

Wicked writes attacker-controlled data into files that follow shell variable assignment conventions, but it never evaluates those files itself. That leaves a latent attack surface, and actual code execution depends entirely on downstream consumers. The indirection makes the bug harder to find by reviewing wicked's code alone. It also explains the gap between the CVSS 3.1 score of 8.8 and the CVSS 4.0 score of 5.8 (which discounts secondary impacts). Organizations should still prioritize based on the 8.8 score, given the demonstrated real-world exploitability of this pattern.

Historical Precedent: CVE-2018-1111 (DynoRoot)

CVE-2026-44932 closely parallels CVE-2018-1111 (DynoRoot), a DHCP command injection vulnerability in Red Hat Enterprise Linux 6 and 7 that Palo Alto Unit 42 analyzed. In that case, dhclient requested the WPAD option (Code 252). Although dhclient initially sanitized the values with backslashes, the 11-dhclient script's read command (without the -r flag) unescaped the characters, and an eval() statement then executed arbitrary commands with root privileges. DynoRoot got a working Metasploit module (exploit/unix/dhcp/rhel_dhcp_client_command_injection), which shows that this class of vulnerability is straightforward to exploit. Both vulnerabilities share the same fundamental flaw: DHCP client data from an untrusted network source flows through insufficient sanitization into a shell evaluation context.

Patch Information

The definitive fix is to update to wicked version 0.6.79, released on June 15, 2026. Marius Tomaschewski wrote the patch, which spans 11 commits across 10 files and takes three complementary approaches.

Strategy 1: Proper Single-Quote Escaping in Leaseinfo Output

The most important change is in src/leaseinfo.c, which gains a new function, ni_leaseinfo_quote_string_value(). When it meets a single quote, it closes the current quoted section, emits an escaped \', and reopens the quoted section. This is the standard POSIX-safe way to embed literal single quotes in single-quoted strings. An additional ni_check_printable() call acts as a secondary gate before any escaping happens.

Strategy 2: Stricter Input Validation for DHCP String Options

The patch also hardens the input path instead of relying on output escaping alone. It adds a new generic utility function in src/util.c:

ni_bool_t
ni_check_string_characters(const char *str, size_t len, int (*valid)(int))
{
    const unsigned char *ptr = (const unsigned char *)str;
    if (!str || len == 0)
        return FALSE;
    for ( ; *ptr && len-- > 0; ++ptr) {
        if (!valid(*ptr))
            return FALSE;
    }
    return TRUE;
}

The function takes a custom callback that validates each character, and the patch uses it to build three new specialized validators in src/dhcp.c:

• ni_dhcp_check_printable_string(): allows printable characters and tab but explicitly rejects the single quote ('). It replaces the old ni_check_printable() in every DHCPv4 and DHCPv6 path that processes string options.
• ni_dhcp_check_posix_tzdbname(): whitelists only alphanumerics plus +, -, _, and / for timezone database names (e.g., America/New_York), in line with RFC 4833 and IEEE Std 1003.1-2024.
• ni_dhcp_check_posix_tzstring(): whitelists the character set that POSIX TZ expanded format strings need (e.g., EST5EDT,M3.2.0,M11.1.0), permitting <, >, +, -, /, :, ., , and alphanumerics.

In src/dhcp4/protocol.c, the DHCP4_POSIX_TZ_STRING and DHCP4_POSIX_TZ_DBNAME cases now go through dedicated parsing functions that apply the matching validator. The patch updates six call sites in src/dhcp6/protocol.c the same way.

Strategy 3: Initrd Regeneration Trigger

Wicked binaries may be embedded in the system's initrd image, so the patch adds %pre, %post, and %posttrans scriptlets to the RPM spec file (wicked.spec.in). They detect upgrades from wicked versions 0.6.78 or earlier and trigger an initrd regeneration, so the vulnerable binary does not stay in the boot image. A package update on its own is not enough if the initrd is not regenerated.

Applying the Patches

SUSE published four coordinated security advisories on June 10, 2026:

On SLE 15 SP7, apply it with zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-2349=1. On other product lines, use zypper patch or YaST online_update.

Network-Level Compensating Controls

Patching is the primary mitigation. These controls reduce exposure:

• Enable DHCP snooping on managed switches to block unauthorized DHCP responses.
• Segment DHCP broadcast domains to limit the adjacent-network attack surface.
• Audit any custom scripts that source /run/wicked/leaseinfo.* files.
• After patching, verify that the initrd has been regenerated.

Detection Methods

Leaseinfo File Inspection (Host-Based IoC)

The most direct way to detect active exploitation or past compromise is to examine the contents of /run/wicked/leaseinfo.* files on affected systems. Vulnerable versions (before 0.6.79) write DHCP option values verbatim, without escaping. Defenders should inspect all leaseinfo files for:

• Values containing unescaped single quotes ('), which would break the key='value' format and enable command injection
• Shell metacharacters such as ;, |, $(), or backticks in any DHCP-sourced field
• Unexpected commands or file paths embedded in option values like POSIXTZSTRING, POSIXTZDBNAME, or any other string-type DHCP parameter

Monitoring the output of wicked test dhcp4 and wicked test dhcp6 can also surface suspicious DHCP responses before they reach the leaseinfo files.

Side-Effect Indicators

The injection happens indirectly, when a third-party script sources the leaseinfo file, so defenders should also look for unexpected side effects that show a payload has executed. The Bugzilla report demonstrates a payload that targets /etc/shadow. Examples include unexpected permission changes on sensitive files, unexpected new files, and unexplained processes running as root during network interface bring-up or initrd initialization.

Package Version Checks

The most reliable way to identify vulnerable systems is to check the installed wicked package version. All versions before 0.6.79 are affected. On SUSE/openSUSE systems, check with rpm -q wicked. Fixed versions by distribution:

• SLES/SLED 15 SP7: wicked-0.6.79-150700.3.3.1
• SLES 15 SP4 LTSS: wicked-0.6.79-150400.3.39.1
• SLES 15 SP5 LTSS: wicked-0.6.79-150500.3.42.1
• SLES 12 SP5 LTSS: wicked-0.6.79-3.56.1

Tenable Nessus Plugins

Tenable has released multiple Nessus plugins for this vulnerability, all published on June 14, 2026. They are local checks based on package version, in the "SuSE Local Security Checks" family:

• Plugin ID 321025 (suse_SU-2026-2349-1.nasl): Covers SUSE SLED15 / SLES15
• Additional plugins cover SUSE-SU-2026:2350-1 (SLES12), SUSE-SU-2026:2353-1 (SLES15 SP5), SUSE-SU-2026:2354-1 (openSUSE Leap 15.4/Micro 5.x), and openSUSE-SU-2026:20949-1 (openSUSE 16)

These plugins support Agentless Assessment, Continuous Assessment, Frictionless Assessment (AWS/Azure), Nessus Agent, and standard Nessus scanning. They rely on the application's self-reported version number and do not attempt active exploitation.

Network-Level Detection

No published Snort, Suricata, YARA, or Sigma rules currently exist for this CVE, but monitoring for rogue DHCP servers is still valuable. Watch in particular for DHCP servers that send unusual values in option 100 (POSIX Timezone String) or option 101 (TZ Database Name). Treat any timezone-related option value that contains shell metacharacters or single quotes as highly suspicious. RFC 4833 restricts legitimate values for these options to specific character sets.

Affected Systems and Versions

All versions of wicked before 0.6.79 are vulnerable. The affected SUSE product lines, as covered by the four security advisories, include:

• SUSE Linux Enterprise Server 12 SP5 LTSS
• SUSE Linux Enterprise Server 15 SP4 LTSS and SLE 15 SP4 SAP
• SUSE Linux Enterprise Server 15 SP5 LTSS, SLE 15 SP5 SAP, and SLE 15 SP5 HPC
• SUSE Linux Enterprise Server 15 SP7 (Desktop, Real Time, Server, SAP), Basesystem Module 15 SP7
• SUSE Linux Enterprise Micro 5.3, 5.4, and 5.5
• openSUSE Leap 15.4 and 15.5
• openSUSE Leap 16.0 (fixed package version 0.6.79-bp160.1.1)

The impact is greatest on systems that use dracut's network-legacy module (notably SLE 15 SP7), because that module's ifup.sh script sources the leaseinfo files and provides the indirect execution path for injected commands.

Vendor Security History

DHCP command injection has recurred across Linux distributions. CVE-2018-1111 (DynoRoot) affected RHEL's dhclient with the same fundamental pattern, and a Metasploit module was developed for it. Wicked now joins dhclient on the list of DHCP clients that have been vulnerable to this class of attack. Both are classified as CWE-78, a well-understood and demonstrably exploitable weakness category.

SUSE's response to this vulnerability was well executed. SUSE's own security personnel discovered the issue internally. The fix was developed and released concurrently across four product lines, with specific patch commands and initrd regeneration triggers, and the advisories went out ahead of the NVD entry. Still, the bug sits in a core networking component on multiple SLE versions (12 SP5 through 15 SP7) and SLE Micro editions, so organizations need a complete inventory of affected hosts and need to patch every one of them.

References

• NVD: CVE-2026-44932
• SUSE Bugzilla: bsc#1265221
• Wicked Release 0.6.79 (GitHub)
• Wicked 0.6.78 to 0.6.79 Diff (GitHub)
• SUSE-SU-2026:2349-1 Advisory
• SUSE-SU-2026:2354-1 (sle-security-updates)
• SUSE-SU-2026:2353-1 (sle-security-updates)
• SUSE-SU-2026:2350-1 (sle-security-updates)
• SUSE-SU-2026:2349-1 (sle-security-updates)
• Mondoo: openSUSE-SU-2026:20949-1
• Tenable Nessus Plugin 321025
• Tenable: CVE-2026-44932
• Tenable Nessus Plugin 321010
• OSV: SUSE-SU-2026:2350-1
• Vulners: CVE-2026-44932
• Unit 42: Analysis of CVE-2018-1111 (DynoRoot)
• Rapid7: DHCP Client Command Injection (DynoRoot)
• CWE-78: OS Command Injection
• LinuxSecurity: SUSE 2026-2349-1 Advisory
• openSUSE/wicked GitHub Repository
• SUSE Security Flaw Remediation Process