CVE catalog

CVE-2023-38321

opennds: CVE-2023-38321

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.10% · Oct 25, 2026

OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference, daemon crash, and Captive Portal outage) via a GET request to /opennds_auth/ that lacks a custom query string parameter and client-token.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianopenndssid10.3.1+dfsg-1fixed
Debianopenndstrixie10.3.1+dfsg-1fixed
Debianopenndsbookworm9.10.0-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianopenndssourcesid10.2.0+dfsg-1not yet assignedNot reported[1059451]
Debianopenndssourcetrixie10.2.0+dfsg-1not yet assignedNot reported[1059451]
Debianopenndssourcebookworm(unfixed)end-of-lifeNot reported[1059451]

[Debian bug #1059451]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]