[CVE-2026-38820] openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injec…

Descripción técnica

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /opennds_preauth/ endpoint because of libopennds.sh.

Puntuación CVSS

Score: 8.3/10 — Severidad: HIGH — Estado NIST: Received

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Debilidades (CWE)

CWE-78

Fuente oficial

Publicado en NIST NVD.