CVE-2026-38820

openNDS before 11.0.0, an open-source captive portal commonly deployed on OpenWrt routers and access points, passes the 'fas' query parameter of the /opennds_preauth/ endpoint through libopennds.sh without proper escaping, enabling shell command injection (CWE-78). An unauthenticated device attached to the portal's network can send a crafted preauth request containing shell metacharacters and achieve arbitrary OS command execution on the host running openNDS. Successful exploitation carries high confidentiality and integrity impact with limited availability impact (CVSS 3.1 8.3, adjacent attack vector), typically giving the attacker control of the router or hotspot at the privilege level of the openNDS process. All deployments running versions prior to 11.0.0 are affected; no public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS estimates a 1.7% probability of exploitation within 30 days (76th percentile).

What to do: Upgrade openNDS to 11.0.0 or later on all captive-portal devices. As interim mitigation, limit reachability of the /opennds_preauth/ endpoint to the guest network segment and filter or validate the fas parameter (e.g., via device firewall rules), and audit OpenWrt deployments for openNDS packages running versions below 11.0.0.