CVE-2023-38314

An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a NULL pointer dereference in preauthenticated() that can be triggered with a crafted GET HTTP request with a missing redirect query string parameter. Triggering this issue results in crashing OpenNDS (a Denial-of-Service condition). Affected OpenNDS Captive Portal before version 10.1.2 fixed infixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on28. August 2023 by updating OpenNDS to version 10.1.3.

• CWE-476

• https://github.com/openNDS/openNDS/releases/tag/v10.1.2Release Notes, Vendor Advisory
• https://github.com/openwrt/routing/commit/0b19771fb2dd81e7c428759610aed583171eed80
• https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006-v4/#sthash.2vJg3d85.rwx82g1C.dpbs
• https://github.com/openNDS/openNDS/releases/tag/v10.1.2Release Notes, Vendor Advisory
• https://github.com/openwrt/routing/commit/0b19771fb2dd81e7c428759610aed583171eed80
• https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006-v4/#sthash.2vJg3d85.rwx82g1C.dpbs

Published

Nov 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-38309An issue was discovered in Webmin 2.021. A Reflected Cross-S…6.1
• CVE-2023-3831A vulnerability was found in Bug Finder Finounce 1.0 and cla…5.4
• CVE-2023-38310An issue was discovered in Webmin 2.021. A Stored Cross-Site…5.4
• CVE-2023-38311An issue was discovered in Webmin 2.021. A Stored Cross-Site…5.4
• CVE-2023-38312A directory traversal vulnerability in Valve Counter-Strike …7.5
• CVE-2023-38313An issue was discovered in OpenNDS Captive Portal before 10.…7.5
• CVE-2023-38315An issue was discovered in OpenNDS Captive Portal before ver…7.5
• CVE-2023-38316An issue was discovered in OpenNDS Captive Portal before ver…9.8
• CVE-2023-38317An issue was discovered in OpenNDS before 10.1.3. It fails t…9.8
• CVE-2023-38318An issue was discovered in OpenNDS before 10.1.3. It fails t…9.8
• CVE-2023-38319An issue was discovered in OpenNDS before 10.1.3. It fails t…9.8
• CVE-2023-3832A vulnerability was found in Bug Finder Wedding Wonders 1.0.…6.1