An issue was discovered in OpenNDS Captive Portal before 10.1.2. it has a do_binauth NULL pointer dereference that can be triggered with a crafted GET HTTP request with a missing client redirect query string parameter. Triggering this issue results in crashing openNDS (a Denial-of-Service condition). The issue occurs when the client is about to be authenticated, and can be triggered only when the BinAuth option is set.

An issue was discovered in OpenNDS Captive Portal before 10.1.2. it has a do_binauth NULL pointer dereference that can be triggered with a crafted GET HTTP request with a missing client redirect query string parameter. Triggering this issue results in crashing openNDS (a Denial-of-Service condition). The issue occurs when the client is about to be authenticated, and can be triggered only when the BinAuth option is set. Affected OpenNDS Captive Portal before version 10.1.2 fixed infixed in OpenWr

MITRE https://github.com/openwrt/routing/commit/0b19771fb2dd81e7c428759610aed583171eed80 [No types assigned]

MITRE https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006-v4/#sthash.2vJg3d85.rwx82g1C.dpbs [No types assigned]

OR
     *cpe:2.3:a:opennds:captive_portal:*:*:*:*:*:*:*:* versions up to (excluding) 10.1.2

NIST AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NIST CWE-476

https://github.com/openNDS/openNDS/releases/tag/v10.1.2 No Types Assigned

https://github.com/openNDS/openNDS/releases/tag/v10.1.2 Release Notes, Vendor Advisory

An issue was discovered in OpenNDS Captive Portal before 10.1.2. it has a do_binauth NULL pointer dereference that can be triggered with a crafted GET HTTP request with a missing client redirect query string parameter. Triggering this issue results in crashing openNDS (a Denial-of-Service condition). The issue occurs when the client is about to be authenticated, and can be triggered only when the BinAuth option is set.

MITRE https://github.com/openNDS/openNDS/releases/tag/v10.1.2 [No types assigned]