{"id":"CVE-2023-38319","aliases":["DEBIAN-CVE-2023-38319","EUVD-2023-42138","GHSA-ppwj-j5xp-6rmh"],"status":"published","title":"An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the...","description":"An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01096,"percentile":0.66051,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2024-01-26T00:00:00Z","modified":"2026-10-28T02:30:41Z","fixes":[{"ecosystem":"Debian:13","package":"opennds","fixed_in":["10.2.0+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"opennds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.2.0+dfsg-1","10.3.0+dfsg-0.1","10.3.1+dfsg-1","9.10.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"opennds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.0+dfsg-1"}]}]}],"products":[{"vendor":"opennds","product":"opennds"}],"references":[{"url":"https://openwrt.org/docs/guide-user/services/captive-portal/opennds","tags":["x_transferred","Product","web"]},{"url":"https://github.com/openNDS/openNDS/releases/tag/v10.1.3","tags":["x_transferred","Release Notes","web"]},{"url":"https://github.com/openNDS/openNDS/blob/master/ChangeLog","tags":["x_transferred","Release Notes","web"]},{"url":"https://www.forescout.com/resources/sierra21-vulnerabilities","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38319","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-ppwj-j5xp-6rmh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38319.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-38319","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-38319","description":"An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands.","status":"published","published":"2024-01-26T00:00:00Z","modified":"2025-06-20T19:37:43.154Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:29.772612Z"}],"euvd":[{"id":"EUVD-2023-42138","description":"An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands.","status":"published","published":"2024-01-26T00:00:00Z","modified":"2025-06-20T19:37:43Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:18.601981Z"}],"ghsa":[{"id":"GHSA-ppwj-j5xp-6rmh","title":"An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the...","description":"An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands.","status":"published","published":"2024-01-26T06:30:30Z","modified":"2024-02-11T05:07:57Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:55:35.698137Z"}],"nvd":[{"id":"CVE-2023-38319","description":"An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands.","status":"published","published":"2024-01-26T05:15:12.063Z","modified":"2026-06-17T06:09:54.08Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:09:01.900189Z"}],"osv":[{"id":"CVE-2023-38319","description":"An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands.","status":"published","published":"2024-01-26T00:00:00Z","modified":"2026-10-28T02:30:41.979469861Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:32.922049Z"},{"id":"DEBIAN-CVE-2023-38319","description":"An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands.","status":"published","published":"2024-01-26T05:15:12.063Z","modified":"2026-10-26T18:02:30.402855501Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:39.980321Z"}]}}