Executive brief
openNDS is an open-source captive portal solution used to manage network access and user authentication on WiFi networks. A heap buffer overflow in the query string parser allows an unauthenticated attacker on the network to crash the service or potentially execute arbitrary code, disrupting internet access for all connected users.
Technical details
A heap-based buffer overflow vulnerability (CWE-122) exists in the query string handling code within http_microhttpd.c in openNDS versions before 11.0.0. The vulnerable component fails to properly validate and bound query string lengths during URL encoding operations, allowing an attacker to write past buffer boundaries. An unauthenticated attacker positioned on the captive portal network can craft a malicious HTTP request with an oversized query string to trigger the overflow. This can result in denial of service through daemon crash or potentially remote code execution. The fix increases the encoded query string buffer size from 1.333× to 1.5× the maximum query length (8192 bytes).
Affected products
- openNDS openNDS before 11.0.0
Timeline
- 2026-08-28: disclosed
- 2026: patched: Fix available in version 11.0.0