CVEvulnerability

CVE-2026-38822

7.6 HIGH Published 2026-08-28 Modified 2026-09-09 Official page ↗
Status
Deferred
Published
2026-08-28
Last modified
2026-09-09
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.6 HIGH — CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Weaknesses
CWE-78

Description

In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References