High severity7.5NVD Advisory· Published Dec 25, 2023· Updated Jun 17, 2026

CVE-2023-38321

Description

OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference, daemon crash, and Captive Portal outage) via a GET request to /opennds_auth/ that lacks a custom query string parameter and client-token.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

OpenNDS/OpenNDSllm-fuzzy
Range: <4.17.0.12
Sierrawireless/Aleosllm-fuzzy2 versions
<4.17.0.12+ 1 more
- (no CPE)range: <4.17.0.12
- cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*range: <4.17.0.12
osv-coords2 versions
pkg:deb/ubuntu/[email protected]+dfsg-1build2?arch=source&distro=oracular pkg:deb/ubuntu/[email protected]+dfsg-1build2?arch=source&distro=noble
>= 0+ 1 more
- (no CPE)range: >= 0
- (no CPE)range: >= 0

Patches

Vulnerability mechanics

References

source.sierrawireless.com/-/media/support_downloads/security-bulletins/pdf/swi-psa-2023-006-r3.ashxnvdVendor Advisory
github.com/openNDS/openNDS/blob/master/ChangeLognvdRelease Notes
openwrt.org/docs/guide-user/services/captive-portal/openndsnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000