CVE-2023-38320

Name of the Vulnerable Software and Affected Versions OpenNDS Captive Portal versions prior to 10.1.2

Description An issue in OpenNDS Captive Portal can be triggered with a crafted GET HTTP request that has a missing User-Agent header, resulting in a NULL pointer dereference. This can cause OpenNDS to crash, leading to a Denial-of-Service condition.

Recommendations For versions prior to 10.1.2, update OpenNDS to version 10.1.3 to resolve the issue. As a temporary workaround, consider restricting access to the show preauthpage function until a patch is available.