CVE-2023-38324

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-38324
An issue was discovered in OpenNDS before 10.1.2. It allows users to skip the splash page sequence (and directly authenticate) when it is using the default FAS key and OpenNDS is configured as FAS. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on 28. August 2023 by updating OpenNDS to version 10.1.3.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cwe.mitre.org/data/definitions/1390.html
https://github.com/openNDS/openNDS/blob/master/ChangeLog
https://github.com/openNDS/openNDS/releases/tag/v10.1.2 Release Notes Vendor Advisory
https://github.com/openwrt/routing/commit/0b19771fb2dd81e7c428759610aed583171eed80
https://openwrt.org/docs/guide-user/services/captive-portal/opennds
https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006-v4/#sthash.2vJg3d85.rwx82g1C.dpbs
https://www.forescout.com/resources/sierra21-vulnerabilities
Configurations

Configuration 1 (hide)

cpe:2.3:a:opennds:captive_portal:*:*:*:*:*:*:*:*
History

20 Jun 2024, 18:15

Type Values Removed Values Added
Summary (en) An issue was discovered in OpenNDS before 10.1.2. It allows users to skip the splash page sequence (and directly authenticate) when it is using the default FAS key and OpenNDS is configured as FAS. (en) An issue was discovered in OpenNDS before 10.1.2. It allows users to skip the splash page sequence (and directly authenticate) when it is using the default FAS key and OpenNDS is configured as FAS. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on 28. August 2023 by updating OpenNDS to version 10.1.3.
References
  • () https://github.com/openwrt/routing/commit/0b19771fb2dd81e7c428759610aed583171eed80 -
  • () https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006-v4/#sthash.2vJg3d85.rwx82g1C.dpbs -

26 Jan 2024, 05:15

Type Values Removed Values Added
Summary An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It allows users to skip the splash page sequence when it is using the default FAS key and when OpenNDS is configured as FAS (default). An issue was discovered in OpenNDS before 10.1.2. It allows users to skip the splash page sequence (and directly authenticate) when it is using the default FAS key and OpenNDS is configured as FAS.
References
  • () https://www.forescout.com/resources/sierra21-vulnerabilities -
  • () https://openwrt.org/docs/guide-user/services/captive-portal/opennds -
  • () https://github.com/openNDS/openNDS/blob/master/ChangeLog -
  • () https://cwe.mitre.org/data/definitions/1390.html -

23 Nov 2023, 03:36

Type Values Removed Values Added
CPE cpe:2.3:a:opennds:captive_portal:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
References () https://github.com/openNDS/openNDS/releases/tag/v10.1.2 - () https://github.com/openNDS/openNDS/releases/tag/v10.1.2 - Release Notes, Vendor Advisory
First Time Opennds
Opennds captive Portal
CWE NVD-CWE-noinfo

17 Nov 2023, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-11-17 06:15

Updated : 2024-06-20 18:15

NVD link : CVE-2023-38324

Mitre link : CVE-2023-38324

CVE.ORG link : CVE-2023-38324

JSON object : View

Products Affected

opennds

  • captive_portal
CWE
NVD-CWE-noinfo