Opennds
Monthly
OS command injection in openNDS before 11.0.0 allows an authenticated captive portal user to execute arbitrary shell commands on the host router by embedding semicolons in HTTP GET query parameter names sent to the client_params.sh script. The daemon-invoked script passes unsanitized parameter keys directly into shell commands, making the exploitation straightforward once an attacker has portal authentication. No public exploit or CISA KEV listing has been identified at time of analysis; an upstream fix is available targeting version 11.0.0.
Heap-based buffer overflow in openNDS before 11.0.0 allows an unauthenticated attacker positioned on the captive portal network to crash the openNDS daemon and potentially execute arbitrary code remotely. The flaw is in the redirect_to_splashpage function in http_microhttpd.c, where the query string buffer is under-allocated at QUERYMAXLEN bytes despite URL encoding expanding input by up to 1.5x - when a crafted request triggers the redirect path, the encoded data overflows the heap allocation. No public exploit identified at time of analysis, though the upstream fix commit is publicly available and exposes the exact vulnerable code path.
Unauthenticated OS command injection in openNDS before 11.0.0 allows any adjacent-network attacker - such as an unprivileged user connected to a captive portal WiFi - to execute arbitrary shell commands on the host router by supplying a crafted `fas` query parameter to the `/opennds_preauth/` endpoint. The vulnerability originates in `libopennds.sh`, which processes the parameter without sanitizing shell metacharacters before passing it to OS-level commands. The fix, published in commit 8c03750, introduces strict base64-character allowlist validation that rejects any query string containing characters outside A-Za-z0-9+/=. No public exploit code or CISA KEV listing has been identified at time of analysis.
Memory exhaustion vulnerabilities in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to crash the portal daemon within minutes by triggering unfreed heap allocations in the authentication handler. The root cause is CWE-401 (missing memory release) in src/auth.c, where intermediate buffers allocated during gateway interface lookups in client_auth() are never freed on certain code paths. No confirmed active exploitation exists and no CISA KEV listing is present, but the attack surface is inherently broad in public hotspot deployments where any connected device can trigger the vulnerable authentication flow.
openNDS 10.2.0 is vulnerable to Use-After-Free via /openNDS/src/auth.c. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the captive portal in OpenNDS before version 10.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Memory Leak vulnerability could allow attackers to exhaust available memory leading to denial of service.
An issue was discovered in the captive portal in OpenNDS before version 10.1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
An issue was discovered in OpenNDS before 10.1.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in OpenNDS Captive Portal before 10.1.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
OS command injection in openNDS before 11.0.0 allows an authenticated captive portal user to execute arbitrary shell commands on the host router by embedding semicolons in HTTP GET query parameter names sent to the client_params.sh script. The daemon-invoked script passes unsanitized parameter keys directly into shell commands, making the exploitation straightforward once an attacker has portal authentication. No public exploit or CISA KEV listing has been identified at time of analysis; an upstream fix is available targeting version 11.0.0.
Heap-based buffer overflow in openNDS before 11.0.0 allows an unauthenticated attacker positioned on the captive portal network to crash the openNDS daemon and potentially execute arbitrary code remotely. The flaw is in the redirect_to_splashpage function in http_microhttpd.c, where the query string buffer is under-allocated at QUERYMAXLEN bytes despite URL encoding expanding input by up to 1.5x - when a crafted request triggers the redirect path, the encoded data overflows the heap allocation. No public exploit identified at time of analysis, though the upstream fix commit is publicly available and exposes the exact vulnerable code path.
Unauthenticated OS command injection in openNDS before 11.0.0 allows any adjacent-network attacker - such as an unprivileged user connected to a captive portal WiFi - to execute arbitrary shell commands on the host router by supplying a crafted `fas` query parameter to the `/opennds_preauth/` endpoint. The vulnerability originates in `libopennds.sh`, which processes the parameter without sanitizing shell metacharacters before passing it to OS-level commands. The fix, published in commit 8c03750, introduces strict base64-character allowlist validation that rejects any query string containing characters outside A-Za-z0-9+/=. No public exploit code or CISA KEV listing has been identified at time of analysis.
Memory exhaustion vulnerabilities in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to crash the portal daemon within minutes by triggering unfreed heap allocations in the authentication handler. The root cause is CWE-401 (missing memory release) in src/auth.c, where intermediate buffers allocated during gateway interface lookups in client_auth() are never freed on certain code paths. No confirmed active exploitation exists and no CISA KEV listing is present, but the attack surface is inherently broad in public hotspot deployments where any connected device can trigger the vulnerable authentication flow.
openNDS 10.2.0 is vulnerable to Use-After-Free via /openNDS/src/auth.c. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the captive portal in OpenNDS before version 10.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Memory Leak vulnerability could allow attackers to exhaust available memory leading to denial of service.
An issue was discovered in the captive portal in OpenNDS before version 10.1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
An issue was discovered in OpenNDS before 10.1.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in OpenNDS Captive Portal before 10.1.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.