CVE-2023-38324 json
An issue was discovered in OpenNDS before 10.1.2.
published 2023-11-17 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-42143
- cvss
- 5.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
An issue was discovered in OpenNDS before 10.1.2. It allows users to skip the splash page sequence (and directly authenticate) when it is using the default FAS key and OpenNDS is configured as FAS. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on 28. August 2023 by updating OpenNDS to version 10.1.3.
Patch / fix
- opennds captive_portal 10.1.2
- opennds Debian 13 10.2.0+dfsg-1
debian advisories DEBIAN-CVE-2023-38324
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.69% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
References
- github.com /openwrt/routing/commit/0b19771fb2dd81e7c428759610aed583171eed80
-
github.com
/openNDS/openNDS/releases/tag/v10.1.2
release-notes, vendor-advisory
- openwrt.org /docs/guide-user/services/captive-portal/opennds
- github.com /openNDS/openNDS/blob/master/ChangeLog
- forescout.com /resources/sierra21-vulnerabilities
- cwe.mitre.org /data/definitions/1390.html
- source.sierrawireless.com /resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006-v4/#sthash.2vJg3d85.rwx82g
Sources
- CVE List CVE-2023-38324
- NVD CVE-2023-38324
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.