OopenNDS

Products

Exploited and recent CVEs

• CVE-2026-38822 High 7.6 In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query 2.3%
• CVE-2026-38821 High 7.1 A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon (denial of service) and pot 0.3%
• CVE-2026-38820 High 8.3 openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /opennds_preauth/ endpoint because of libopennds.sh. 2.9%
• CVE-2026-38819 Medium 5.3 Multiple memory leaks in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to exhaust all available memory on the device within minutes. 0.3%