CVE-2026-38822

Deferred Deferred - Pending Action

OS Command Injection in openNDS Before 11.0.0

Publication date: 2026-08-28

Last updated on: 2026-09-09

Assigner: MITRE

Description

In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-09

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-38822

EUVD

EUVD-2026-67362

Affected Vendors & Products

Vendor	Product	Version / Range
opends	opends	to 11.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

In openNDS before version 11.0.0, there is an OS command injection vulnerability in the client_params.sh script. This script is used by the openNDS daemon to serve the authenticated client status page. An authenticated user can exploit this by crafting HTTP GET query parameter keys with semicolons, allowing them to inject arbitrary shell commands.

Detection Guidance

To detect this vulnerability, inspect the openNDS daemon logs for unusual client status page requests containing semicolons in query parameter names. Check for commands executed by the client_params.sh script. Review network traffic for crafted HTTP GET requests targeting the authenticated client status page.

Impact Analysis

An authenticated captive portal user could execute arbitrary commands on the system running openNDS. This could lead to unauthorized access, data theft, or system compromise depending on the privileges of the openNDS service.

Compliance Impact

This vulnerability allows authenticated users to execute arbitrary shell commands via crafted HTTP query parameters, which could lead to unauthorized access, data exfiltration, or system compromise. Such breaches may violate GDPR's data protection requirements or HIPAA's security rules by exposing sensitive user data or network resources.

Mitigation Strategies

Upgrade openNDS to version 11.0.0 or later to patch the OS command injection flaw. If upgrading is not immediately possible, restrict access to the captive portal interface and monitor for suspicious activity. Disable the client status page feature if not required.

Hi! I’m here to help you understand CVE-2026-38822. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70