CVE-2023-38316
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. When the custom unescape callback is enabled, attackers can execute arbitrary OS commands by inserting them into the URL
02 Description
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. When the custom unescape callback is enabled, attackers can execute arbitrary OS commands by inserting them into the URL
03 Exploitation and scoring
- Exploitation
- Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.
- SSVC decision
- ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
- AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
- Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.
- EPSS probability
- 1.08% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 65.0% of scored records. A rank, not a probability.
- NVD base score
- 9.8 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVD analysis status
- Modified. NVD last modified this record on 2026-06-17.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2023-11-17 00:00Z2 YR AGO
- Last updated
- 2024-09-04 20:19Z2 YR AGO
- Reserved
- 2023-07-14
- Assigning CNA
- mitre
- Record state
- PUBLISHED
- Severity
- Not rated by the issuing CNA
- CNA CVSS vector
- Not published by the issuing CNA
- Weaknesses
- CWE-116Improper Encoding or Escaping of OutputClass
- Data version
- 5.1
- Document digest
- a3097951a58637b505096ad884b3d485c1f5f0c2815ba76945cb5a4bb5a0174e
05 Affected products
06 References
- github.comhttps://github.com/openNDS/openNDS/releases/tag/v10.1.2
- github.comhttps://github.com/openwrt/routing/commit/0b19771fb2dd81e7c428759610aed583171eed80
- source.sierrawireless.comhttps://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006-v4/#sthash.2vJg3d85.rwx82g1C.dpbs
07 Fixed in
Debian 12
- opennds No fix yet
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 13
- opennds Fixed in 10.2.0+dfsg-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.