Cloudanix VulnDB

CVE-2023-38321

High · 7.5

CVSS

7.5

EPSS

1.1%

Published

Dec 25, 2023

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in some wireless network devices lets attackers remotely crash the login system that controls network access, knocking the service offline until it restarts.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Trivial
Impact
Denial Of Service
Component
Application
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A NULL pointer dereference in the OpenNDS daemon triggered by a GET request to /opennds_auth/ that omits the custom query string parameter and client-token causes the process to crash and the captive portal to become unavailable.

Why it matters to the business

Outages of network authentication services on affected wireless routers disrupt user connectivity and access control, leading to operational downtime in environments relying on captive portals.

How an attack unfolds

An attacker discovers an exposed OpenNDS captive portal on a vulnerable Sierra Wireless device and sends a crafted GET request to the /opennds_auth/ endpoint without the required parameters, triggering the NULL pointer dereference and daemon crash.

How to fix it

Upgrade Sierra Wireless ALEOS to version 4.17.0.12 or later on affected models including LX40, LX60, MP70, RV50x, and RV55. Restrict network access to the captive portal endpoint and implement input validation proxies if immediate patching is not feasible.

How to confirm the fix worked

Test the /opennds_auth/ endpoint with requests lacking the required parameters after applying updates to confirm the daemon no longer crashes. Review process logs for stable operation and absence of NULL dereference faults.

Typical attack path

  1. Scan for exposed OpenNDS captive portal endpoints on target devices
  2. Send a GET request to /opennds_auth/ omitting the custom query string parameter and client-token
  3. Confirm service crash and captive portal outage

How to detect it

Review web access logs and OpenNDS daemon logs for GET requests to /opennds_auth/ that lack a client-token parameter, along with sudden process crashes or restarts around the same timestamps.

  • /opennds_auth/
  • GET.*opennds_auth.*client-token
  • opennds daemon crash
  • NULL pointer dereference in OpenNDS

What your security team should do

  • Prioritize firmware updates to ALEOS 4.17.0.12 or newer on all listed device models
  • Apply network ACLs to block unauthenticated access to /opennds_auth/
  • Enable logging of authentication requests and monitor for anomalous patterns
  • Validate captive portal redundancy or failover configurations

The record

OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference, daemon crash, and Captive Portal outage) via a GET request to /opennds_auth/ that lacks a custom query string parameter and client-token.

Affected packages

Ecosystem Package Introduced Fixed
Debian:12 opennds 0 No fix
Debian:13 opennds 0 10.2.0+dfsg-1
Debian:14 opennds 0 10.2.0+dfsg-1
Ubuntu:24.04:LTS opennds 0 No fix
Ubuntu:24.10 opennds 0 No fix

Related vulnerabilities