EUVD-2026-67360
GHSA-hw32-3v67-92pf
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Adjacent vector confirmed by captive portal architecture; no auth or complexity required; OS command execution yields full C/I impact with minor availability effect.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Lifecycle Timeline
4DescriptionCVE.org
openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /opennds_preauth/ endpoint because of libopennds.sh.
AnalysisAI
Unauthenticated OS command injection in openNDS before 11.0.0 allows any adjacent-network attacker - such as an unprivileged user connected to a captive portal WiFi - to execute arbitrary shell commands on the host router by supplying a crafted fas query parameter to the /opennds_preauth/ endpoint. The vulnerability originates in libopennds.sh, which processes the parameter without sanitizing shell metacharacters before passing it to OS-level commands. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be on the same adjacent network segment as the captive portal - specifically, connected to the WiFi network managed by openNDS but not yet authenticated through the portal. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector (AV:A/AC:L/PR:N/UI:N) accurately characterizes the realistic threat: an attacker must be on the adjacent network segment - connected to the captive portal WiFi before authentication - but requires no credentials and faces no complexity barrier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade openNDS to version 11.0.0 or later, which incorporates the fix from commit 8c03750d9a17d601fa7bd03ae7cde20c7c8d1252. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all deployed instances of openNDS and verify current versions, assess network isolation of the /opennds_preauth/ endpoint and determine guest WiFi user reach. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in the captive portal in OpenNDS before version 10.1.3. Rated critical severity (CVSS 9.8), this
openNDS 10.2.0 is vulnerable to Use-After-Free via /openNDS/src/auth.c. Rated medium severity (CVSS 5.5), this vulnerabi
OS command injection in openNDS before 11.0.0 allows an authenticated captive portal user to execute arbitrary shell com
An issue was discovered in the captive portal in OpenNDS before version 10.1.3. Rated high severity (CVSS 7.5), this vul
Heap-based buffer overflow in openNDS before 11.0.0 allows an unauthenticated attacker positioned on the captive portal
Memory exhaustion vulnerabilities in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal netwo
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today