CVE-2023-38320

An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a show_preauthpage NULL pointer dereference that can be triggered with a crafted GET HTTP with a missing User-Agent header. Triggering this issue results in crashing OpenNDS (a Denial-of-Service condition). This problem was fixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on 28. August 2023 by updating OpenNDS to version 10.1.3.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 62%
VendorProductVersion
openndscaptive_portal
𝑥
< 10.1.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
opennds
bookworm
vulnerable
sid
10.3.0+dfsg-0.1
fixed
trixie
10.3.0+dfsg-0.1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
opennds
oracular
needs-triage
noble
needs-triage
mantic
ignored
lunar
ignored
jammy
dne
focal
dne
bionic
ignored
xenial
ignored
trusty
ignored
Common Weakness Enumeration
References
https://github.com/openNDS/openNDS/releases/tag/v10.1.2
https://github.com/openwrt/routing/commit/0b19771fb2dd81e7c428759610aed583171eed80
https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.2vJg3d85.dpbs
https://github.com/openNDS/openNDS/releases/tag/v10.1.2
https://github.com/openwrt/routing/commit/0b19771fb2dd81e7c428759610aed583171eed80
https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.2vJg3d85.dpbs