Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-38324

Good to know:

icon

Date: November 16, 2023

An issue was discovered in OpenNDS before 10.1.2. It allows users to skip the splash page sequence (and directly authenticate) when it is using the default FAS key and OpenNDS is configured as FAS. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on 28. August 2023 by updating OpenNDS to version 10.1.3.

Language: C

Severity Score

Related Resources (10)

https://github.com/openNDS/openNDS/blob/master/ChangeLog
https://cwe.mitre.org/data/definitions/1390.html
https://github.com/openwrt/routing/commit/0b19771fb2dd81e7c428759610aed583171eed80
https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006-v4/#sthash.2vJg3d85.rwx82g1C.dpbs
https://github.com/openNDS/openNDS/releases/tag/v10.1.2
https://nvd.nist.gov/vuln/detail/CVE-2023-38324
https://security-tracker.debian.org/tracker/CVE-2023-38324
https://www.forescout.com/resources/sierra21-vulnerabilities
https://openwrt.org/docs/guide-user/services/captive-portal/opennds
https://www.mend.io/vulnerability-database/CVE-2023-38324

Severity Score

Weakness Type (CWE)

Insufficient Information

NVD-CWE-noinfo

Top Fix

icon

Upgrade Version

Upgrade to version v10.1.2

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us