EUVD-2026-67361
GHSA-rm65-3jj4-3vcm
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
AV:A retained for captive portal adjacency; A:H corrects the provided A:L since daemon crash constitutes full availability loss regardless of restart behavior; AC:H retained as reliable RCE requires heap layout control.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon (denial of service) and potentially achieve remote code execution. This is in http_microhttpd.c.
AnalysisAI
Heap-based buffer overflow in openNDS before 11.0.0 allows an unauthenticated attacker positioned on the captive portal network to crash the openNDS daemon and potentially execute arbitrary code remotely. The flaw is in the redirect_to_splashpage function in http_microhttpd.c, where the query string buffer is under-allocated at QUERYMAXLEN bytes despite URL encoding expanding input by up to 1.5x - when a crafted request triggers the redirect path, the encoded data overflows the heap allocation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be connected to the adjacent captive portal network - physically or via Wi-Fi on the segment where openNDS is serving portal redirects - but need not be authenticated through the portal. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L scores 7.1 (High). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade openNDS to version 11.0.0 or later, which incorporates the fix from commit 3b5f7ef40cd048826d3c4a16f61a73a1768fd5a9 correcting the ENC_QUERYSTR buffer allocation in redirect_to_splashpage; the patch is available at https://github.com/openNDS/openNDS/commit/3b5f7ef40cd048826d3c4a16f61a73a1768fd5a9. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running openNDS and document their versions; contact the openNDS project to confirm patch timeline and check for any interim security advisories. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in the captive portal in OpenNDS before version 10.1.3. Rated critical severity (CVSS 9.8), this
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. Rated critical severity (CVSS 9.8), this vulner
openNDS 10.2.0 is vulnerable to Use-After-Free via /openNDS/src/auth.c. Rated medium severity (CVSS 5.5), this vulnerabi
Unauthenticated OS command injection in openNDS before 11.0.0 allows any adjacent-network attacker - such as an unprivil
OS command injection in openNDS before 11.0.0 allows an authenticated captive portal user to execute arbitrary shell com
An issue was discovered in the captive portal in OpenNDS before version 10.1.3. Rated high severity (CVSS 7.5), this vul
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. Rated high severity (CVSS 7.5), this vulnerabil
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. Rated high severity (CVSS 7.5), this vulnerabil
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. Rated high severity (CVSS 7.5), this vulnerabil
An issue was discovered in OpenNDS Captive Portal before 10.1.2. Rated high severity (CVSS 7.5), this vulnerability is r
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. Rated medium severity (CVSS 6.5), this vulnerab
Memory exhaustion vulnerabilities in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal netwo
Same weakness CWE-122 – Heap-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today