An issue was discovered in the captive portal in OpenNDS before version 10.1.3.

published 2023-11-17 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-45621

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 62%
public exploits: 0; none known

An issue was discovered in the captive portal in OpenNDS before version 10.1.3. It has multiple memory leaks due to not freeing up allocated memory. This may lead to a Denial-of-Service condition due to the consumption of all available memory. Affected OpenNDS before version 10.1.3 fixed in OpenWrt master and OpenWrt 23.05 on 23. November by updating OpenNDS to version 10.2.0.

Patch / fix

fixed in 1 distros 1 links 3

opennds opennds 10.1.3

opennds Debian 13 10.2.0+dfsg-1

debian advisories DEBIAN-CVE-2023-41102

github.com/openNDS/openNDS@31dbf4a commit
github.com/openwrt/routing@ad787a9 commit
github.com/openNDS/openNDS/releases/tag/v10.1.3 release

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 y ago (2024-06-24)

Exploit prediction

0.97% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

opennds opennds

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption
CWE-401 Missing Release of Memory after Effective Lifetime

References

Sources

CVE List CVE-2023-41102
NVD CVE-2023-41102

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary