CVE-2018-1111: Red Hat DHCP client NetworkManager script command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw gives unauthenticated root code execution from the local network, public exploits exist, and EPSS is near the top percentile, though it requires adjacent network access and affected platforms are older.

What it is

The DHCP client packages in Red Hat Enterprise Linux 6 and 7, Fedora 28 and earlier ship a NetworkManager integration script that is vulnerable to command injection. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, can inject commands that run as root on systems using NetworkManager and DHCP. Because the flaw yields root code execution on affected hosts, it is a serious risk for any environment still running these distributions.

Impact

An attacker gains arbitrary command execution with root privileges on the affected host, allowing full system compromise, persistence, and lateral movement from the compromised machine.

Attack surface

The flaw is reached over the local network via DHCP responses, so an attacker must be on the same broadcast domain or able to spoof DHCP traffic; no authentication or user interaction is required. The CVSS vector AV:A/AC:H/PR:N/UI:N reflects adjacent access with high attack complexity.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high (0.9797, 99.9th percentile) and public exploit code exists in Exploit-DB (44652, 44890), indicating mature, widely available exploitation.

What to do

• Apply the Red Hat errata (RHSA-2018:1453 through RHSA-2018:1461 and RHSA-2018:1524) or the corresponding Fedora updates to patch the DHCP client packages.
• If patching cannot be done immediately, disable NetworkManager DHCP handling or use a non-vulnerable DHCP client configuration on affected hosts.
• Enable DHCP snooping and port security on switches to block rogue DHCP servers and spoofed DHCP responses on the local segment.
• Segment or isolate networks where untrusted devices can send DHCP traffic, and restrict DHCP server addresses to known, authorized servers.
• Verify patched package versions after remediation and re-check any hosts that were exposed before patching.

Detection

• Monitor DHCP client logs and NetworkManager logs for unexpected script execution or unusual command strings in DHCP options.
• Alert on rogue or unexpected DHCP servers on the network using DHCP snooping logs or network monitoring.
• Hunt for suspicious root-level process creation shortly after DHCP lease acquisition on affected hosts.
• Check endpoint and configuration management data for unpatched dhclient/NetworkManager packages on RHEL 6/7 and Fedora systems.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.