In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to… (CVE-2026-38822)

The client_params.sh script in openNDS prior to version 11.0.0 is vulnerable to OS command injection. The vulnerability arises because the script processes HTTP GET query parameter keys without proper sanitization, allowing an authenticated captive portal user to inject shell commands by including semicolons in the parameter names. This can lead to arbitrary command execution with the privileges of the openNDS daemon.

Successful exploitation allows an authenticated user to execute arbitrary shell commands on the system running openNDS, potentially leading to full compromise of the affected host. The vulnerability impacts confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:L).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the authenticated client status page to trusted users only and monitor for suspicious activity related to crafted HTTP GET requests targeting the client_params.sh script.