Packages / Debian 13 (Trixie) / Source / net / opennds
manage access to public internet access (service daemon)
manage access to public internet access (service helper scripts)
Matching against OpenFactory catalog package versions is in progress.
| CVE | Severity | Version impact |
|---|---|---|
| [CVE-2026-38822] Published: In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query | High(7.6) | AffectedDetails (4)
|
| [CVE-2026-38821] Published: A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon (denial of service) and pot | High(7.1) | AffectedDetails (4)
|
| [CVE-2026-38820] Published: openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /opennds_preauth/ endpoint because of libopennds.sh. | High(8.3) | AffectedDetails (4)
|
| [CVE-2026-38819] Published: Multiple memory leaks in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to exhaust all available memory on the device within minutes. | Medium(5.3) | AffectedDetails (4)
|
Last synced:
Authoritative source; repository metadata signature verified
trixie-main-amd64:3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
Authoritative source; repository metadata signature verified
trixie-main-arm64:753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908