CVE-2024-25763

What it actually does

Use-after-free condition in auth.c authentication handling allows a freed memory pointer to be dereferenced, resulting in memory corruption that may enable denial of service or arbitrary code execution.

Why it matters to the business

An attacker could crash the captive portal service or gain control of the gateway device, disrupting network access control and potentially exposing connected users or internal networks.

How an attack unfolds

An attacker interacts with the authentication endpoint in a crafted sequence that causes the program to free a structure and later reuse the dangling pointer, leading to memory corruption that can be leveraged for code execution.

How to fix it

Update openNDS to the latest stable release that resolves the use-after-free in src/auth.c. If an immediate update is unavailable, restrict unauthenticated access to the captive portal interface and monitor for abnormal memory usage.

How to confirm the fix worked

Confirm the installed version is newer than 10.2.0 and review source or changelog entries for auth.c fixes; perform memory safety testing or code review on the authentication path.

Typical attack path

1. Send crafted authentication requests to trigger allocation and subsequent free of auth structures
2. Time subsequent requests to reuse the freed memory region with attacker-controlled data
3. Trigger dereference of the dangling pointer to corrupt memory or redirect execution flow

How to detect it

Review openNDS process logs and system memory error reports for repeated crashes or segmentation faults during authentication; correlate with unusual request patterns to the auth endpoint.

What your security team should do

• Apply the latest openNDS update as the primary remediation
• Harden network exposure of the captive portal and disable unnecessary authentication features
• Implement runtime memory protection or sandboxing where supported by the platform