Francesco La Spina

**Name of the Vulnerable Software and Affected Versions** openNDS versions prior to 11.0.0 **Description** Unauthenticated OS command execution is possible via shell command injection. This occurs through the `fas` query parameter on the '/opennds preauth/' endpoint due to an issue in libopennds.sh. **Recommendations** Update to version 11.0.0 or later. Avoid using the `fas` parameter in the '/opennds preauth/' endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** openNDS versions prior to 11.0.0 **Description** A heap-based buffer overflow occurs in the `http microhttpd.c` file. This allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon, resulting in a denial of service, or potentially achieve remote code execution. A heap-based buffer overflow is a condition where a program writes more data to a heap memory buffer than it can hold, potentially overwriting adjacent memory. **Recommendations** Update to version 11.0.0 or later.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined. **Description** An unauthenticated remote attacker can upload a .aspx file instead of a PV system picture through the demo account. The code can only be executed in the security context of the user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.