CVE-2023-38314

An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a NULL pointer dereference in preauthenticated that can be triggered with a crafted GET HTTP request with a missing redirect query string parameter. Triggering this issue results in crashing OpenNDS a Denial-of-Servic...

CVE-2023-38316

An issue was discovered in OpenNDS Captive Portal before version 10.1.2. When the custom unescape callback is enabled, attackers can execute arbitrary OS commands by inserting them into the URL portion of HTTP GET requests. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt...

CVE-2023-38322

An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a dobinauth NULL pointer dereference that be triggered with a crafted GET HTTP request with a missing User-Agent HTTP header. Triggering this issue results in crashing OpenNDS a Denial-of-Service condition. The issue...

CVE-2023-38320

An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a showpreauthpage NULL pointer dereference that can be triggered with a crafted GET HTTP with a missing User-Agent header. Triggering this issue results in crashing OpenNDS a Denial-of-Service condition. This problem...

CVE-2023-38316: Improper Encoding or Escaping of Output

An issue was discovered in OpenNDS Captive Portal before version 10.1.2. When the custom unescape callback is enabled, attackers can execute arbitrary OS commands by inserting them into the URL portion of HTTP GET requests. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt...

CVE-2023-38322: NULL Pointer Dereference

An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a dobinauth NULL pointer dereference that be triggered with a crafted GET HTTP request with a missing User-Agent HTTP header. Triggering this issue results in crashing OpenNDS a Denial-of-Service condition. The issue...

CVE-2023-38313: NULL Pointer Dereference

An issue was discovered in OpenNDS Captive Portal before 10.1.2. it has a dobinauth NULL pointer dereference that can be triggered with a crafted GET HTTP request with a missing client redirect query string parameter. Triggering this issue results in crashing openNDS a Denial-of-Service condition...

CVE-2023-41101

An issue was discovered in the captive portal in OpenNDS before version 10.1.3. getquery in httpmicrohttpd.c does not validate the length of the query string of GET requests. This leads to a stack-based buffer overflow in versions 9.x and earlier, and to a heap-based buffer overflow in versions...

CVE-2023-41102

An issue was discovered in the captive portal in OpenNDS before version 10.1.3. It has multiple memory leaks due to not freeing up allocated memory. This may lead to a Denial-of-Service condition due to the consumption of all available memory. Affected OpenNDS before version 10.1.3 fixed in OpenW...

CVE-2023-41102

The CVE-2023-41102 vulnerability affects OpenNDS before version 10.1.3, where the captive portal has multiple memory leaks due to not freeing allocated memory, potentially causing a Denial-of-Service by exhausting memory. The issue is mitigated by upgrading to OpenNDS version 10.2.0, which has be...

CVE-2023-38324

An issue was discovered in OpenNDS before 10.1.2. It allows users to skip the splash page sequence and directly authenticate when it is using the default FAS key and OpenNDS is configured as FAS. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt master, OpenWrt 23.05 and...

CVE-2023-41102

An issue was discovered in the captive portal in OpenNDS before version 10.1.3. It has multiple memory leaks due to not freeing up allocated memory. This may lead to a Denial-of-Service condition due to the consumption of all available memory. Affected OpenNDS before version 10.1.3 fixed in OpenW...

PT-2023-26356

Name of the Vulnerable Software and Affected Versions OpenNDS Captive Portal versions prior to 10.1.2 OpenNDS Captive Portal version 10.1.2 is not affected, as the issue is fixed in version 10.1.3. Description An issue was discovered in OpenNDS Captive Portal. When the custom unescape callback is...

CVE-2023-41101

CVE-2023-41101 affects OpenNDS prior to 10.1.3. The vulnerability is in get_query() of http_microhttpd.c, which does not validate the length of the GET query string, leading to a stack-based overflow on 9.x and earlier and a heap-based overflow on 10.x and later. Impacted systems may crash (DoS) ...

CVE-2023-38322

CVE-2023-38322 affects OpenNDS Captive Portal prior to 10.1.2. A do_binauth NULL pointer dereference can be triggered by a crafted GET request with a missing User-Agent header, causing a Denial-of-Service when the client is about to be authenticated and BinAuth is enabled. The issue is mitigated ...

CVE-2023-38313

CVE-2023-38313 affects OpenNDS Captive Portal prior to 10.1.2. A NULL pointer dereference in do_binauth can be triggered by a crafted GET request with a missing client redirect parameter, leading to Denial-of-Service (crash) when BinAuth is enabled. A fix is available: OpenNDS 10.1.3; updates wer...

CVE-2023-38324

CVE-2023-38324 affects OpenNDS before 10.1.2, where a vulnerability in the FAS configuration allows users to skip the splash page and directly authenticate using the default FAS key. A fix was released by updating to OpenNDS 10.1.3; OpenWrt master, OpenWrt 23.05, and OpenWrt 22.03 include this up...

CVE-2023-38320

CVE-2023-38320 describes a NULL pointer dereference in OpenNDS Captive Portal before 10.1.2. A crafted GET request with a missing User-Agent header can trigger this, leading to a Denial-of-Service (OpenNDS crash). The issue has a concrete fix: OpenNDS was updated to version 10.1.3, and patches we...

CVE-2023-38314

CVE-2023-38314 affects OpenNDS Captive Portal before version 10.1.2, where a NULL pointer dereference in preauthenticated() can be triggered by a crafted GET request with a missing redirect query string parameter, causing a Denial-of-Service. The issue is mitigated by updating OpenNDS to version ...

CVE-2023-38315

An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a trytoauthenticate NULL pointer dereference that can be triggered with a crafted GET HTTP with a missing client token query string parameter. Triggering this issue results in crashing OpenNDS a Denial-of-Service...