5.3

CVE-2023-38324

EPSS 0.56%
Veröffentlicht 17.11.2023 06:15:33
Zuletzt bearbeitet 21.11.2024 08:13:20
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

An issue was discovered in OpenNDS before 10.1.2. It allows users to skip the splash page sequence (and directly authenticate) when it is using the default FAS key and OpenNDS is configured as FAS. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on 28. August 2023 by updating OpenNDS to version 10.1.3.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 10

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Opennds ≫ Captive Portal Version < 10.1.2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.56%	0.678

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Es wurden noch keine Informationen zu CWE veröffentlicht.

https://github.com/openNDS/openNDS/releases/tag/v10.1.2

Vendor Advisory

Release Notes

https://github.com/openwrt/routing/commit/0b19771fb2dd81e7c428759610aed583171eed80

https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006-v4/#sthash.2vJg3d85.rwx82g1C.dpbs

https://cwe.mitre.org/data/definitions/1390.html

https://github.com/openNDS/openNDS/blob/master/ChangeLog

https://openwrt.org/docs/guide-user/services/captive-portal/opennds

https://www.forescout.com/resources/sierra21-vulnerabilities

https://nvd.nist.gov/vuln/detail/CVE-2023-38324

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-38324

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-38324

EUVD