CVE-2026-38822 — HIGH (7.6)

Vulnerability Description

In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.

CVSS Score

7.6

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

LOW

Related Weaknesses (CWE)

CWE-78

References

https://github.com/openNDS/openNDS/commit/294983e859bb678eef7db06fc9f6afab0b489d

FAQ

What is CVE-2026-38822?

CVE-2026-38822 is a vulnerability with a CVSS score of 7.6 (HIGH). In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query...

How severe is CVE-2026-38822?

CVE-2026-38822 has been rated HIGH with a CVSS base score of 7.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-38822?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.