by Kastro
Paper/Archive/CVE-2023-38319

CVE-2023-38319

mitre — An issue was discovered in OpenNDS before 10.1.3.

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 65.6.656 × 2013.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refopenwrt.org/docs/guide-user/services/captive-portal/openndsrefgithub.com/openNDS/openNDS/releases/tag/v10.1.3refgithub.com/openNDS/openNDS/blob/master/ChangeLogrefforescout.com/resources/sierra21-vulnerabilities