CVE-2023-38321

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2023-38321

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-38321.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-38321

Downstream

DEBIAN-CVE-2023-38321

Related

UBUNTU-CVE-2023-38321

Published

2023-12-25T09:15:07Z

Modified

2025-08-09T19:01:27Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference, daemon crash, and Captive Portal outage) via a GET request to /opennds_auth/ that lacks a custom query string parameter and client-token.

References

https://github.com/openNDS/openNDS/blob/master/ChangeLog
https://source.sierrawireless.com/-/media/support_downloads/security-bulletins/pdf/swi-psa-2023-006-r3.ashx
https://openwrt.org/docs/guide-user/services/captive-portal/opennds

CVE-2023-38321

Affected packages