CVE-2026-44096

Deferred Deferred - Pending Action

Privilege Escalation in udhcpc via Local Command Execution

Publication date: 2026-07-30

Last updated on: 2026-07-31

Assigner: CERT VDE

Description

A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-31

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-44096

EUVD

EUVD-2026-51031

Affected Vendors & Products

Vendor	Product	Version / Range
phoenix_contact	charx_sec-3xxx	to 1.9.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is a privilege escalation vulnerability in udhcpc where a local user named charx-web can run arbitrary commands as the root user. This allows full control over the affected system.

Impact Analysis

If exploited, an attacker with local access could gain root privileges, install malware, steal data, or take complete control of the system. This could lead to data breaches or system-wide compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties.

Mitigation Strategies

Update udhcpc to the latest patched version immediately. Remove or restrict local user 'charx-web' permissions until the update is applied. Monitor system logs for unusual root-level command execution attempts.

Hi! I’m here to help you understand CVE-2026-44096. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70