openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the… (CVE-2026-38820)

CVE-2026-38820 is a command injection vulnerability in openNDS before version 11.0.0. It allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell commands through the 'fas' query parameter on the /opennds_preauth/ endpoint. The root cause is unsafe processing in the libopennds.sh script. The CVSS v3.1 base score is 8.3, indicating high severity with attack vector as adjacent network, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity, with low impact on availability.

Successful exploitation enables unauthenticated attackers to execute arbitrary OS commands remotely, potentially leading to full system compromise including confidentiality and integrity breaches. Availability impact is low. There are no known exploits in the wild as of the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the data. Until a patch is available, restrict access to the /opennds_preauth/ endpoint and monitor for suspicious activity related to the 'fas' parameter.