openNDS CVE-2026-38822

Exploitation requires two concrete prerequisites: the attacker must have successfully authenticated to the openNDS captive portal (PR:L - a captive portal login is sufficient, no administrator or privileged account is needed), and must be on the same adjacent network segment as the captive portal interface (AV:A). The vulnerable code path is only triggered when the client_params.sh script is invoked to serve the authenticated client status page - meaning the feature must be active, which it is by default in a standard openNDS deployment. No additional non-default configuration is required. Exploitation is bounded by the adjacency requirement (internet-based attackers without network presence cannot directly reach the portal) and by the need to complete captive portal authentication before injecting commands. The injection point is specifically the query parameter key name, not the value, which may bypass naive input filters that only sanitize parameter values.

The CVSS 7.6 score with vector AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L accurately reflects the real-world risk profile. The adjacent-network vector (AV:A) confines the attacker pool to users already on the same broadcast domain as the captive portal interface, which meaningfully limits internet-scale exposure. PR:L requires successful captive portal authentication before exploitation, adding a second barrier. However, the technical impact is severe: openNDS typically runs as root on OpenWrt devices, so successful command injection yields full router compromise including confidentiality and integrity of all traffic passing through the device. No EPSS data was provided in the available intelligence, and no KEV listing or POC code has been identified - these are unknown rather than confirmed-absent. Even small-scale operators running openNDS-based hotspots for guest or public Wi-Fi should treat this as high priority, given that the captive portal's authenticated user base represents an already semi-trusted attacker population with reliable adjacent access.

An attacker authenticates to the openNDS captive portal through normal means, then crafts an HTTP GET request to the client status page with a URL query parameter key containing a semicolon followed by an arbitrary shell command - for example, GET /status?legit;id=value. The client_params.sh script processes the parameter key without sanitization and passes it to a shell invocation, executing the injected command in the context of the openNDS daemon. Because openNDS typically runs as root on OpenWrt, this grants full device control. No public POC has been identified at time of analysis.