VulnerabilityModified
CVE-2023-38324
It allows users to skip the splash page sequence (and directly authenticate) when it is using the default FAS key and OpenNDS is configured as FAS.
MEDIUM 5.3EPSS 0.69%
Does this matter?
Lower severity and a low EPSS score (0.69%). Track it; it rarely justifies an emergency change on its own.
Description
An issue was discovered in OpenNDS before 10.1.2. It allows users to skip the splash page sequence (and directly authenticate) when it is using the default FAS key and OpenNDS is configured as FAS. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on 28. August 2023 by updating OpenNDS to version 10.1.3.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 0.69% probability · 51th percentile
- CISA KEV
- Not listed
- Affected
- opennds/captive portal
- Source
- cve@mitre.org
References
- https://cwe.mitre.org/data/definitions/1390.html
- https://github.com/openNDS/openNDS/blob/master/ChangeLog
- https://github.com/openNDS/openNDS/releases/tag/v10.1.2Release Notes, Vendor Advisory
- https://github.com/openwrt/routing/commit/0b19771fb2dd81e7c428759610aed583171eed80
- https://openwrt.org/docs/guide-user/services/captive-portal/opennds
- https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006-v4/#sthash.2vJg3d85.rwx82g1C.dpbs
- https://www.forescout.com/resources/sierra21-vulnerabilities
- https://cwe.mitre.org/data/definitions/1390.html
- https://github.com/openNDS/openNDS/blob/master/ChangeLog
- https://github.com/openNDS/openNDS/releases/tag/v10.1.2Release Notes, Vendor Advisory
- https://github.com/openwrt/routing/commit/0b19771fb2dd81e7c428759610aed583171eed80
- https://openwrt.org/docs/guide-user/services/captive-portal/opennds
- https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006-v4/#sthash.2vJg3d85.rwx82g1C.dpbs
- https://www.forescout.com/resources/sierra21-vulnerabilities
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.