Description
An issue was discovered in OpenNDS before 10.1.2. It allows users to skip the splash page sequence (and directly authenticate) when it is using the default FAS key and OpenNDS is configured as FAS. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on 28. August 2023 by updating OpenNDS to version 10.1.3.
References (7)
Core 7
Core References
Various Sources
https://cwe.mitre.org/data/definitions/1390.html
Various Sources
https://www.forescout.com/resources/sierra21-vulnerabilities
Release Notes, Vendor Advisory
https://github.com/openNDS/openNDS/releases/tag/v10.1.2
Scores
CVSS v3
5.3
EPSS
0.0056
EPSS Percentile
68.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
Status
published
Products (1)
opennds/captive_portal
< 10.1.2
Published
Nov 17, 2023
Tracked Since
Feb 18, 2026