CVE-2026-38822
In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the...
In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.
- Record
CVE-2026-38822- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2026-67362
In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.
- Record
EUVD-2026-67362- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2h6c-w4mg-27v5
In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the...
In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.
- Record
GHSA-2h6c-w4mg-27v5- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.
- Record
CVE-2026-38822- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-78
- Updated
- 2026-11-02
OSV
In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.
- Record
CVE-2026-38822- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-78
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-38822
In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.
- Record
DEBIAN-CVE-2026-38822- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-38822
In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.
- Record
UBUNTU-CVE-2026-38822- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openndsDebian:12 |
All versions, plus listed versions 10.2.0+dfsg-110.3.0+dfsg-0.110.3.1+dfsg-19.10.0-1 |
None known |
openndsDebian:13 |
All versions, plus listed versions 10.3.1+dfsg-1 |
None known |
openndsUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 9.10.0-110.2.0+dfsg-110.2.0+dfsg-1build110.2.0+dfsg-1build210.2.0+dfsg-1ubuntu0.24.04.1~esm1 |
None known |
openndsUbuntu:26.10 |
All versions, plus listed versions 10.3.1+dfsg-1build1 |
None known |
openndsUbuntu:26.04:LTS |
All versions, plus listed versions 10.3.1+dfsg-110.3.1+dfsg-1build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-38822 is a high vulnerability (CVSS 7.6) in Opennds, published August 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.28%, the 83rd percentile. No source names a fixed version.
References
github.com/openNDS/openNDS/commit/294983e859bb678eef7db06fc9f6afab0b489d8e
nvd.nist.gov/vuln/detail/CVE-2026-38822
security-tracker.debian.org/tracker/CVE-2026-38822
ubuntu.com/security/CVE-2026-38822
cve.org/CVERecord?id=CVE-2026-38822