PT-2026-48679 · Wicked · Wicked

CVE-2026-44932 · Published 2026-06-10 · Updated 2026-06-18

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wicked versions prior to 0.6.79

Description An indirect remote shell command injection exists due to unsanitized DHCP options. The issue involves improper processing of posix-tz-dbname and tz-string options, as well as a failure to escape single-quotes in leaseinfo dump output used by wicked test dhcp4 and wicked test dhcp6 and written to /run/wicked/leaseinfo.* files.

Recommendations Update to version 0.6.79. Regenerate the initrd if it contains wicked binaries when updating from versions 0.6.78 and earlier.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-44932

OPENSUSE-SU-2026:11018-1

OPENSUSE-SU-2026:20949-1

SUSE-SU-2026:2349-1

SUSE-SU-2026:2350-1

SUSE-SU-2026:2353-1

SUSE-SU-2026:2354-1

Affected Products

Wicked

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44932.json · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2026:20949-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2350-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:11018-1 · Vendor Advisory
• https://lists.suse.com/pipermail/sle-security-updates/2026-June/026690.html · Vendor Advisory
• https://lists.suse.com/pipermail/sle-security-updates/2026-June/026691.html · Vendor Advisory
• https://lists.suse.com/pipermail/sle-security-updates/2026-June/026688.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44932 · Security Note
• https://osv.dev/vulnerability/CVE-2026-44932 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2354-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2353-1 · Vendor Advisory
• https://lists.suse.com/pipermail/sle-security-updates/2026-June/026689.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2349-1 · Vendor Advisory
• https://github.com/openSUSE/wicked · Note
• https://github.com/openSUSE/wicked/releases/tag/version-0.6.79 · Note