CVE-2023-38322

CVE-2023-38322 affects OpenNDS Captive Portal prior to 10.1.2. A do_binauth NULL pointer dereference can be triggered by a crafted GET request with a missing User-Agent header, causing a Denial-of-Service when the client is about to be authenticated and BinAuth is enabled. The issue is mitigated ...