High severity7.5NVD Advisory· Published Nov 17, 2023· Updated Jun 17, 2026
CVE-2023-38320
CVE-2023-38320
Description
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a show_preauthpage NULL pointer dereference that can be triggered with a crafted GET HTTP with a missing User-Agent header. Triggering this issue results in crashing OpenNDS (a Denial-of-Service condition). This problem was fixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on 28. August 2023 by updating OpenNDS to version 10.1.3.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
6cpe:2.3:a:opennds:captive_portal:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:opennds:captive_portal:*:*:*:*:*:*:*:*range: <10.1.2
- (no CPE)
- osv-coords2 versionspkg:deb/ubuntu/[email protected]+dfsg-1build2?arch=source&distro=noblepkg:deb/ubuntu/[email protected]+dfsg-1build2?arch=source&distro=oracular
>= 0+ 1 more
- (no CPE)range: >= 0
- (no CPE)range: >= 0
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.