CVE-2026-38822: openNDS Command Injection RCE Vulnerability

CVE-2026-38822 Overview

CVE-2026-38822 is an OS command injection vulnerability in openNDS, an open-source captive portal daemon commonly deployed on OpenWrt and other Linux-based network gateways. The flaw resides in the client_params.sh script, which the openNDS daemon invokes to render the authenticated client status page. The script fails to sanitize HTTP GET query parameter keys before passing them to the shell. An authenticated captive portal user on the adjacent network can inject arbitrary shell commands by embedding semicolons in a URL query parameter name. The issue affects all versions of openNDS prior to 11.0.0 and is tracked as CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
Authenticated captive portal clients can execute arbitrary shell commands on the gateway device running openNDS, potentially resulting in full compromise of the network appliance.

Affected Products

openNDS versions prior to 11.0.0
Devices and firmware distributions bundling openNDS as a captive portal component
OpenWrt-based routers and gateways deploying openNDS

Discovery Timeline

2026-08-28 - CVE-2026-38822 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-38822

Vulnerability Analysis

openNDS handles captive portal client interactions through the openNDS daemon, which delegates client status page rendering to the shell script client_params.sh located under forward_authentication_service/libs/. The script consumes HTTP GET query parameters and interpolates parameter names into shell expressions without validation or encoding.

Because the parameter keys are inserted into command contexts, a client can supply a key containing shell metacharacters. A semicolon terminates the current command and begins a new one, allowing the attacker to append arbitrary shell payloads that execute with the privileges of the openNDS daemon.

Exploitation requires the attacker to be an authenticated captive portal user on the adjacent network, which lowers the barrier considerably on open guest Wi-Fi deployments. Successful exploitation grants command execution on the gateway, exposing routing configuration, credentials, and traffic to compromise.

Root Cause

The root cause is missing input sanitization on HTTP query parameter names in client_params.sh. The script relied on shell parameter expansion without URL-encoding user-controlled tokens, so any character permitted in a URL query string was carried directly into shell command construction.

Attack Vector

An attacker associates with the captive portal, completes authentication, and issues a crafted HTTP GET request to the status page endpoint. The request contains a query parameter whose key includes a semicolon followed by shell commands. When openNDS invokes client_params.sh, the injected commands execute on the host.

bash

# Patch excerpt from client_params.sh introducing URL encoding of parameter values
urlencode() {
	entitylist="
		s/%/%25/g
		s/\s/%20/g
		s/\"/%22/g
		s/>/%3E/g
		s/</%3C/g
		s/'/%27/g
		s/\`/%60/g
	"
	local buffer="$1"

	for entity in $entitylist; do
		urlencoded=$(echo "$buffer" | sed "$entity")
		buffer=$urlencoded
	done

	urlencoded=$(echo "$buffer" | awk '{ gsub(/\$/, "\\%24"); print }')
}

get_option_from_config() {
	if [ ! -z "$1" ]; then
		param=$(/usr/lib/opennds/libopennds.sh get_option_from_config "$1")
		# urlencode
		urlencode "$param"
		param=$urlencoded
	fi
}

Source: openNDS commit 294983e

Detection Methods for CVE-2026-38822

Indicators of Compromise

HTTP GET requests to the openNDS status endpoint containing semicolons, backticks, or $( sequences within query parameter names.
Unexpected child processes spawned by the openNDS daemon or by client_params.sh such as sh, wget, curl, nc, or busybox invocations.
New or modified files under /tmp, /var/run, or persistence locations on the gateway shortly after captive portal authentication events.
Outbound connections from the gateway to attacker-controlled hosts following captive portal client activity.

Detection Strategies

Inspect openNDS access logs for URL-encoded or literal shell metacharacters (%3B, ;, `, $() in query string keys.
Monitor process ancestry on the gateway for shell processes whose parent is the openNDS daemon.
Correlate authenticated portal sessions with subsequent anomalous outbound network flows originating from the gateway itself.

Monitoring Recommendations

Forward openNDS and system logs from gateway devices to a centralized SIEM or data lake for retention and correlation.
Alert on execution of interpreters (sh, awk, wget, curl) triggered by the openNDS process tree.
Baseline normal captive portal request patterns and flag deviations in query parameter structure.

How to Mitigate CVE-2026-38822

Immediate Actions Required

Upgrade openNDS to version 11.0.0 or later on all affected gateway devices.
Audit gateway firmware bundles and OpenWrt package repositories to confirm the patched openNDS version is deployed.
Review captive portal authentication logs for suspicious client activity predating the patch.

Patch Information

The fix is applied in openNDS 11.0.0 via commit 294983e859bb678eef7db06fc9f6afab0b489d8e. The patch introduces a urlencode helper in client_params.sh that neutralizes shell metacharacters in parameter values before they enter command contexts. See the openNDS security commit for the complete change.

Workarounds

Restrict captive portal access to trusted users where feasible until the patch is applied.
Place gateways running vulnerable openNDS behind network segmentation that limits lateral movement from the guest network.
Disable the openNDS status page feature if operational requirements permit, pending upgrade.