CVEvulnerability
CVE-2023-38319
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2024-01-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-78
Description
An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands.
Affected configurations
• opennds opennds (< 10.1.3)
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- https://github.com/openNDS/openNDS/blob/master/ChangeLog Release Notes
- https://github.com/openNDS/openNDS/releases/tag/v10.1.3 Release Notes
- https://openwrt.org/docs/guide-user/services/captive-portal/opennds Product
- https://www.forescout.com/resources/sierra21-vulnerabilities Exploit, Third Party Advisory
- https://github.com/openNDS/openNDS/blob/master/ChangeLog Release Notes
- https://github.com/openNDS/openNDS/releases/tag/v10.1.3 Release Notes
- https://openwrt.org/docs/guide-user/services/captive-portal/opennds Product
- https://www.forescout.com/resources/sierra21-vulnerabilities Exploit, Third Party Advisory