CVE-2023-38317 is a critical severity (CVSS 9.8) OS command injection in OpenNDS before 10.1.3: the network interface name in the configuration file is not sanitized. Anyone who can influence that file can run commands. Upgrade to 10.1.3 or later and review who can write the configuration.
What's affected
The affected product is OpenNDS, a captive portal used on routers and access points, with versions before 10.1.3. The flaw is that the program does not sanitize the network interface name entry in the configuration file, so attackers with direct or indirect access to that file can run arbitrary operating system commands. The record is dated 2024-01-26 and scores 9.8, Critical, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
The record points to the OpenNDS ChangeLog and the v10.1.3 release, and to Forescout's SIERRA:21 research. The v10.1.3 release page describes security fixes and lists two other CVE numbers. It does not name this one, so confirm in the ChangeLog and your firmware vendor's notes that the fix for this issue is included. Three sibling CVEs, CVE-2023-38318, CVE-2023-38319 and CVE-2023-38323, are the same pattern for other configuration entries.
Weakness class: CWE-78.
How to check if you're exposed
On OpenWrt and similar systems, list the installed package version.
opkg list-installed | grep -i opennds
On other systems, use the package manager or check the binary's version output. Many routers bundle OpenNDS inside vendor firmware, so check the firmware release notes. Then review who and what can write the OpenNDS configuration file, including any web interface or provisioning tool that edits it.
What to do now
- List devices that run OpenNDS, including those where it is bundled in vendor firmware.
- Upgrade to 10.1.3 or later, or install the firmware update that includes it.
- Restrict write access to the OpenNDS configuration file to root and trusted tooling.
- Check any web interface or provisioning script that edits the configuration and make sure it validates values.
- Review the configuration for unexpected values in interface, gateway and path entries.
Why it matters
The weakness is command injection through configuration. The program takes a value from its configuration file and uses it when it runs a shell command, without cleaning it. If the value contains shell syntax, the shell runs it with the privileges of the OpenNDS process, which on a router is often root.
Configuration files are easy to treat as trusted, but they are often written by web interfaces, cloud management tools or scripts that take input from elsewhere. That is the indirect access the record mentions. The CVE is not on the CISA Known Exploited Vulnerabilities list, and the sources I read do not report exploitation.
OS command injection happens when a program builds a shell command from data it does not fully control. If the data contains shell syntax, the shell runs it with the program's privileges. The safe approach is to avoid the shell, pass arguments as separate values, and validate configuration values against a strict allow list before use.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. It does not see firmware, desktop software or vendor appliances, so keep this item in your asset inventory and track the vendor's advisory.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can someone exploit this remotely?
The vector says network, but the description says the attacker needs direct or indirect access to the configuration file. Anything that writes that file on a user's behalf counts as indirect access.
Does 10.1.3 fix the sibling CVEs?
The record says all four affect versions before 10.1.3, but the release page does not list them by number. Check the ChangeLog and your firmware vendor.
Sources
Last reviewed: 19 October 2026.
