Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

18 records

Vendor: openNDS Clear all filters
TI-2026-28216 CVE-2026-38822 · GHSA-2h6c-w4mg-27v5

OS command injection in openNDS

Priority MEDIUM 40

In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys.

CVSS 3.1HIGH 7.6 Adjacent network Low privileges No interaction EPSS 0.02279 Published 2026-08-28 Fixed in 11.0.0 CWE-78
TI-2026-28215 CVE-2026-38821 · GHSA-rm65-3jj4-3vcm

Heap-based buffer overflow in openNDS

Priority LOW 33

A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon (denial of service) and potentially achieve rem…

CVSS 3.1HIGH 7.1 Adjacent network No auth No interaction EPSS 0.00307 Published 2026-08-28 Fixed in 11.0.0 CWE-122
TI-2026-28214 CVE-2026-38820 · GHSA-hw32-3v67-92pf

OS command injection in openNDS

Priority MEDIUM 43

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /opennds_preauth/ endpoint because of libopennds.sh.

CVSS 3.1HIGH 8.3 Adjacent network No auth No interaction EPSS 0.02869 Published 2026-08-28 Fixed in 11.0.0 CWE-78
TI-2026-28213 CVE-2026-38819 · GHSA-53cw-ggrv-83hg

Memory leak in openNDS

Priority LOW 24

Multiple memory leaks in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to exhaust all available memory on the device within minutes.

CVSS 3.1MEDIUM 5.3 Adjacent network No auth No interaction EPSS 0.00256 Published 2026-08-28 Fixed in 11.0.0 CWE-401