CVE-2026-38822: OS Command Injection
In openNDS before 11.0.0, the clientparams.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
OpenNDS deployments running a version before 11.0.0 are affected where the daemon serves the authenticated client status page. The vulnerable component is the client_params.sh script invoked for that page.
What access does an attacker need to exploit it?
The attacker must be an authenticated captive portal user. Exploitation does not require user interaction and is performed by sending an HTTP GET request with a crafted query parameter name containing semicolons.
What is the impact of successful exploitation?
A successful attacker can inject and execute arbitrary shell commands through the vulnerable script. The stated impact includes high confidentiality and integrity impact and low availability impact.
How can I remediate the issue?
Upgrade openNDS to version 11.0.0 or later. The issue affects versions before 11.0.0.