Bluewavenet

An issue in OpenNDS Captive Portal can be triggered with a crafted GET HTTP request with a missing `client redirect` query string parameter, resulting in a NULL pointer dereference. This can cause OpenNDS to crash, leading to a Denial-of-Service condition. The issue occurs during client authentication and can only be triggered when the `BinAuth` option is set.

An issue was discovered in OpenNDS Captive Portal that has a NULL pointer dereference in the `preauthenticated()` function. This can be triggered with a crafted GET HTTP request with a missing `redirect` query string parameter. Triggering this issue results in crashing OpenNDS, leading to a Denial-of-Service condition.

An issue in OpenNDS Captive Portal can be triggered with a crafted GET HTTP request that has a missing `client token` query string parameter, resulting in a NULL pointer dereference in the `try to authenticate` function. This can cause OpenNDS to crash, leading to a Denial-of-Service condition.

An issue was discovered in OpenNDS Captive Portal. When the custom unescape callback is enabled, attackers can execute arbitrary OS commands by inserting them into the URL portion of HTTP GET requests.

An issue in OpenNDS Captive Portal can be triggered with a crafted GET HTTP request that has a missing `User-Agent` header, resulting in a NULL pointer dereference. This can cause OpenNDS to crash, leading to a Denial-of-Service condition.

An issue in OpenNDS Captive Portal can be triggered with a crafted GET HTTP request with a missing User-Agent HTTP header, resulting in a NULL pointer dereference. This can cause OpenNDS to crash, leading to a Denial-of-Service condition. The issue occurs during client authentication and can only be triggered when the BinAuth option is set.

An issue was discovered in OpenNDS that allows users to skip the splash page sequence and directly authenticate when it is using the default FAS key and OpenNDS is configured as FAS.