CVE-2026-38822 in openNDS
Summary
by MITRE • 08/28/2026
In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in versions of openNDS prior to 11.0.0 represents a critical security flaw within the authentication mechanism of the Captive Portal software, specifically affecting the client_params.sh script which is responsible for generating and serving the authenticated client status page. This component is invoked by the main openNDS daemon whenever it needs to display information about connected clients or their session states. The core technical issue stems from improper input validation and sanitization practices when processing HTTP GET query parameters passed in URLs requesting this status page. Specifically, the script fails to adequately escape or restrict special shell metacharacters within parameter keys before they are utilized in system commands executed by the underlying operating system's command interpreter.
An authenticated user of the captive portal can exploit this weakness through OS Command Injection, a vulnerability classified under CWE-78 in the Common Weakness Enumeration standard. By crafting specific HTTP GET requests where the query parameter names contain semicolons and other shell control characters, an attacker can break out of the intended command context. The openNDS daemon processes these parameters without sufficient filtering, allowing the injected commands to be executed with the privileges of the user account running the openNDS process. This typically results in arbitrary code execution on the host system hosting the captive portal infrastructure, potentially granting attackers full control over the device depending on the service's configuration and permissions.
The operational impact of this vulnerability is severe due to its potential for remote exploitation by any authenticated user. Once an attacker gains access to the network behind the openNDS gateway and authenticates through the captive portal, they are no longer restricted to normal web browsing activities. Instead, they can leverage the command injection flaw to execute arbitrary shell commands on the server. This could lead to a complete compromise of the host system, including data exfiltration, installation of backdoors, pivoting into internal network segments, or denial of service by disrupting critical services running on the same machine. The attack vector is straightforward and does not require complex exploitation techniques beyond constructing malicious URLs with embedded shell commands in parameter keys.
Mitigation strategies primarily involve upgrading to openNDS version 11.0.0 or later where this issue has been addressed through improved input validation and safer command execution practices. In environments where immediate patching is not feasible, administrators should implement strict access controls on the captive portal interface to limit who can authenticate and interact with status pages. Additionally, deploying a Web Application Firewall may help detect and block requests containing suspicious shell metacharacters in query parameters before they reach the vulnerable application logic. Regular security audits of configuration scripts that invoke system commands are also recommended to ensure adherence to secure coding standards such as those outlined by OWASP for preventing command injection attacks.