CVE-2026-38822 | High | 7.6 | 2026-08-28 | In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command… |
CVE-2026-38821 | High | 7.1 | 2026-08-28 | A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the o… |
CVE-2026-38820 | High | 8.3 | 2026-08-28 | openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /opennds_preaut… |
CVE-2026-38819 | Medium | 5.3 | 2026-08-28 | Multiple memory leaks in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to exhaust all available memory on the device wi… |
CVE-2024-25763 | Medium | 5.5 | 2024-02-26 | openNDS 10.2.0 is vulnerable to Use-After-Free via /openNDS/src/auth.c. |
CVE-2023-38323 | Critical | 9.8 | 2024-01-26 | An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the status path script entry in the configuration file, allowing attackers that have dir… |
CVE-2023-38319 | Critical | 9.8 | 2024-01-26 | An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the configuration file, allowing attackers that have direct or indi… |
CVE-2023-38318 | Critical | 9.8 | 2024-01-26 | An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the gateway FQDN entry in the configuration file, allowing attackers that have direct or… |
CVE-2023-38317 | Critical | 9.8 | 2024-01-26 | An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the network interface name entry in the configuration file, allowing attackers that have… |
CVE-2023-41102 | High | 7.5 | 2023-11-17 | An issue was discovered in the captive portal in OpenNDS before version 10.1.3. It has multiple memory leaks due to not freeing up allocated memory. This may l… |
CVE-2023-41101 | Critical | 9.8 | 2023-11-17 | An issue was discovered in the captive portal in OpenNDS before version 10.1.3. get_query in http_microhttpd.c does not validate the length of the query string… |
CVE-2023-38324 | Medium | 5.3 | 2023-11-17 | An issue was discovered in OpenNDS before 10.1.2. It allows users to skip the splash page sequence (and directly authenticate) when it is using the default FAS… |
CVE-2023-38322 | High | 7.5 | 2023-11-17 | An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a do_binauth NULL pointer dereference that be triggered with a crafted GET HTTP… |
CVE-2023-38320 | High | 7.5 | 2023-11-17 | An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a show_preauthpage NULL pointer dereference that can be triggered with a crafte… |
CVE-2023-38316 | Critical | 9.8 | 2023-11-17 | An issue was discovered in OpenNDS Captive Portal before version 10.1.2. When the custom unescape callback is enabled, attackers can execute arbitrary OS comma… |
CVE-2023-38315 | High | 7.5 | 2023-11-17 | An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a try_to_authenticate NULL pointer dereference that can be triggered with a cra… |
CVE-2023-38314 | Medium | 6.5 | 2023-11-17 | An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a NULL pointer dereference in preauthenticated() that can be triggered with a c… |
CVE-2023-38313 | High | 7.5 | 2023-11-17 | An issue was discovered in OpenNDS Captive Portal before 10.1.2. it has a do_binauth NULL pointer dereference that can be triggered with a crafted GET HTTP req… |