CVE catalog

CVE-2023-38320

opennds: CVE-2023-38320

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.96% · Oct 25, 2026

An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a show_preauthpage NULL pointer dereference that can be triggered with a crafted GET HTTP with a missing User-Agent header. Triggering this issue results in crashing OpenNDS (a Denial-of-Service condition). This problem was fixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on 28. August 2023 by updating OpenNDS to version 10.1.3.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianopenndssid10.3.1+dfsg-1fixed
Debianopenndstrixie10.3.1+dfsg-1fixed
Debianopenndsbookworm9.10.0-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianopenndssourcesid10.2.0+dfsg-1not yet assignedNot reported[1059451]
Debianopenndssourcetrixie10.2.0+dfsg-1not yet assignedNot reported[1059451]
Debianopenndssourcebookworm(unfixed)end-of-lifeNot reported[1059451]

[Debian bug #1059451]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]