dhclient in ISC DHCP 3.0.x through 4.2.x before 4.2.1-P1, 3.1-ESV before 3.1-ESV-R1, and 4.1-ESV before 4.1-ESV-R2 allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message, as demonstrated by a hostname that is provided to dhclient-script.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade dhclientUpgrade libdhcp4client-develUpgrade libdhcp4clientUpgrade dhcpUpgrade dhcp-devel | Dec 1, 2016 | Apr 8, 2011 |
| Debian | — | Upgrade isc-dhcp | Jul 30, 2024 | Apr 8, 2011 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 5, 2013 |
| Freebsd | — | Upgrade isc-dhcp31-clientUpgrade isc-dhcp41-client | Dec 10, 2025 | Apr 10, 2011 |
| Gentoo Linux | — | Upgrade net-misc/dhcp. | Oct 30, 2017 | Apr 8, 2011 |
| Oracle_linux | — | Upgrade dhcpUpgrade libdhcp4client-develUpgrade libdhcp4clientUpgrade dhcp-develUpgrade dhclient | Oct 16, 2024 | Apr 8, 2011 |
| Suse | — | Upgrade dhcp-develUpgrade libdhcp6client-1_0-2Upgrade libdhcp6client-develUpgrade dhcpcdUpgrade dhcpUpgrade dhcp-relayUpgrade dhcp-clientUpgrade dhcp-serverUpgrade dhcp-keamaUpgrade dhcpv6 | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade dhcp3-client | Nov 8, 2024 | Apr 8, 2011 |
| Vmsa 2011 0010 | — | Upgrade VMware ESX 4.1 to build number 433742Upgrade VMware ESX 3.5 to build number 604481Upgrade VMware ESX 4.0 to build number 480973 | Aug 2, 2011 | Jul 28, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub