EUVD-2026-67362
GHSA-2h6c-w4mg-27v5
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Adjacent-only reach and captive portal authentication (PR:L) bound the attacker pool; shell injection on a root-running daemon yields high C/I; A:L reflects partial disruption rather than full denial.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Lifecycle Timeline
4DescriptionCVE.org
In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.
AnalysisAI
OS command injection in openNDS before 11.0.0 allows an authenticated captive portal user to execute arbitrary shell commands on the host router by embedding semicolons in HTTP GET query parameter names sent to the client_params.sh script. The daemon-invoked script passes unsanitized parameter keys directly into shell commands, making the exploitation straightforward once an attacker has portal authentication. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concrete prerequisites: the attacker must have successfully authenticated to the openNDS captive portal (PR:L - a captive portal login is sufficient, no administrator or privileged account is needed), and must be on the same adjacent network segment as the captive portal interface (AV:A). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.6 score with vector AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L accurately reflects the real-world risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade openNDS to version 11.0.0 or later, which incorporates the fix from commit 294983e859bb678eef7db06fc9f6afab0b489d8e (https://github.com/openNDS/openNDS/commit/294983e859bb678eef7db06fc9f6afab0b489d8e) - this adds URL-encoding sanitization of all configuration parameters before shell interpolation, directly eliminating the injection vector. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit openNDS deployments and review captive portal access logs for suspicious activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in the captive portal in OpenNDS before version 10.1.3. Rated critical severity (CVSS 9.8), this
openNDS 10.2.0 is vulnerable to Use-After-Free via /openNDS/src/auth.c. Rated medium severity (CVSS 5.5), this vulnerabi
Unauthenticated OS command injection in openNDS before 11.0.0 allows any adjacent-network attacker - such as an unprivil
An issue was discovered in the captive portal in OpenNDS before version 10.1.3. Rated high severity (CVSS 7.5), this vul
Heap-based buffer overflow in openNDS before 11.0.0 allows an unauthenticated attacker positioned on the captive portal
Memory exhaustion vulnerabilities in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal netwo
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today