CVE-2026-38822

openNDS before 11.0.0 contains an OS command injection flaw (CWE-78) in the client_params.sh helper script that the openNDS daemon invokes to serve the authenticated client status page. Because HTTP GET query parameter keys reach the shell without sanitization, an authenticated captive portal user can embed semicolons in a parameter name to inject and execute arbitrary shell commands on the gateway. An attacker who has already joined the captive-portal network gains command execution with the daemon's privileges, exposing sensitive device configuration and allowing configuration changes (CVSS: adjacent network, low privileges, high confidentiality/integrity impact). All deployments running openNDS prior to 11.0.0 are affected, including instances bundled with OpenWrt and other embedded router firmware. No public proof-of-concept or confirmed in-the-wild exploitation is known; EPSS estimates about a 0.8% probability of exploitation within 30 days and the flaw is not in CISA KEV.

What to do: Upgrade to openNDS 11.0.0 or later (update the opennds package on OpenWrt and other affected firmware). If upgrading is not immediately possible, restrict portal access to trusted users and filter or reject semicolons in URL query parameter keys at the front end. Prioritize reviewing internet-facing or guest-facing openNDS deployments, since those present the easiest attack path for authenticated users.