CVE-2023-38319

CVSS 9.8 CRITICALEPSS 1.1%CWE-78

Vexday Risk Score

28Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 9.8EPSS 1.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

26 ene 2024Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Productos afectados

n/a · n/a

Referencias

https://github.com/openNDS/openNDS/blob/master/ChangeLog https://github.com/openNDS/openNDS/releases/tag/v10.1.3 https://openwrt.org/docs/guide-user/services/captive-portal/opennds https://www.forescout.com/resources/sierra21-vulnerabilities