openNDS CVE-2026-38820

The attacker must be on the same adjacent network segment as the captive portal - specifically, connected to the WiFi network managed by openNDS but not yet authenticated through the portal. The /opennds_preauth/ endpoint must be reachable by connecting clients, which is the default and intended configuration for captive portal operation. The Forward Authentication Service (FAS) feature must be active (the vulnerable code path is in libopennds.sh, which serves the FAS pre-auth flow). No credentials or prior authentication are required (PR:N per CVSS). Exploitation is limited to adjacent-network attackers (AV:A) - internet-based remote exploitation is not possible without first gaining WiFi connectivity. The affected product versions are all openNDS releases prior to 11.0.0.

The CVSS vector (AV:A/AC:L/PR:N/UI:N) accurately characterizes the realistic threat: an attacker must be on the adjacent network segment - connected to the captive portal WiFi before authentication - but requires no credentials and faces no complexity barrier. This adjacency requirement meaningfully limits the attacker pool compared to a fully internet-facing flaw, though any guest user can exploit it trivially. The High confidentiality and integrity impact scores are well-founded given that OS command execution on an OpenWrt router can compromise routing tables, credentials, and downstream network traffic. Even a mid-sized municipal IT team in rybnik managing community WiFi should treat this as an urgent patch priority, since the pre-auth endpoint is by design exposed to all connecting clients. EPSS data was not provided, making probabilistic exploitation forecasting unavailable; however, the simplicity of the attack (low complexity, no auth, publicly visible commit diff exposing the vulnerability class) suggests exploitation is accessible to moderately skilled actors. No CISA KEV listing was found, and no standalone POC has been identified, but the commit diff itself serves as a technical roadmap for exploit development.

An attacker connects to a WiFi network managed by a vulnerable openNDS captive portal - no credentials required at this stage since this is the pre-authentication phase. The attacker sends an HTTP request to /opennds_preauth/ with a crafted fas parameter containing shell metacharacters (e.g., semicolons or backticks wrapping arbitrary commands), which libopennds.sh passes directly to the OS shell. The injected command executes with the privileges of the openNDS process on the underlying OpenWrt router, potentially enabling full device compromise including persistent backdoor installation or network traffic interception.