Skip to content
OpenAdvisories
High · 8.8 CVE-2026-44932 EUVD-2026-37127GHSA-hc32-vf4h-9cg4

indirect remote shell command injection via unsanitized DHCP options in wicked

Published Jun 16, 2026 · Updated Jun 18, 2026 · Assigned by suse

Vendor: SUSE Product: wicked

Description

Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.

Affected products

VendorProductAffectedFixed
SUSE wicked < 0.6.79 0.6.79

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 wicked 0.6.79-150700.3.3.1 SUSE-SU-2026:2349-1
SLES 15 SP6 wicked 0.6.79-150600.11.20.1 SUSE-SU-2026:3840-1
SLES 15 SP5 wicked 0.6.79-150500.3.42.1 SUSE-SU-2026:2353-1
SLES 15 SP4 wicked 0.6.79-150400.3.39.1 SUSE-SU-2026:2354-1
SLES 12 SP5 wicked 0.6.79-3.56.1 SUSE-SU-2026:2350-1
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 wicked 0.6.79-150600.11.20.1 SUSE-SU-2026:3840-1
SLES for SAP 15 SP5 wicked 0.6.79-150500.3.42.1 SUSE-SU-2026:2353-1
SLES for SAP 15 SP4 wicked 0.6.79-150400.3.39.1 SUSE-SU-2026:2354-1
SLE Micro 5.5 wicked 0.6.79-150500.3.42.1 SUSE-SU-2026:2353-1
SLE Micro 5.4 wicked 0.6.79-150400.3.39.1 SUSE-SU-2026:2354-1
SLE Micro 5.3 wicked 0.6.79-150400.3.39.1 SUSE-SU-2026:2354-1
SLE HPC 15 SP5 wicked 0.6.79-150500.3.42.1 SUSE-SU-2026:2353-1
SLE HPC 15 SP4 wicked 0.6.79-150400.3.39.1 SUSE-SU-2026:2354-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed wicked 0.6.79-1.1 openSUSE-SU-2026:11018-1
openSUSE Leap 16.0 wicked 0.6.79-bp160.1.1 openSUSE-SU-2026:20949-1

Advisories 7

References