# CVE-2026-38822: openNDS command injection in client_params.sh

Source: https://junglewise.ai/threats/cve-2026-38822-opennds-command-injection-in-client-params-sh  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-38822 · Severity: high · CVSS 7.6 · Published 2026-08-28

openNDS is a network access control system that manages captive portal authentication for guest WiFi and hotspot networks. A vulnerability in the client status page script allows authenticated users to inject and execute arbitrary operating system commands by crafting malicious URLs, potentially compromising server integrity and enabling lateral movement within the network.

Technologies: [openNDS](https://junglewise.ai/threats/technologies/opennds). Vendors: [openNDS](https://junglewise.ai/threats/vendors/opennds).

## Quick answers

**Is CVE-2026-38822 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-38822 being exploited in the wild.

**How severe is CVE-2026-38822?** High severity, with a CVSS score of 7.6, published 28 August 2026.

**Which products and versions are affected?** openNDS before 11.0.0.

**Is there a fix for CVE-2026-38822?** A patch was published on 2026: Fix available in version 11.0.0 and commit 294983e Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-38822 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-38822?** Check whether you run openNDS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an OS command injection flaw in the client_params.sh script, which processes HTTP GET query parameters from authenticated captive portal users. The script fails to properly sanitize query parameter names, allowing attackers to inject shell metacharacters (such as semicolons) to break out of intended command context and execute arbitrary commands with the privileges of the openNDS daemon. Attack requires prior authentication to the captive portal, but no additional user interaction is needed once authenticated. The vulnerability affects openNDS before version 11.0.0 and is addressed in commit 294983e.

## Affected products

- openNDS openNDS before 11.0.0

## Timeline

- 2026-08-28: disclosed
- 2026: patched: Fix available in version 11.0.0 and commit 294983e

## References

- [https://github.com/openNDS/openNDS/commit/294983e859bb678eef7db06fc9f6afab0b489d8e](https://github.com/openNDS/openNDS/commit/294983e859bb678eef7db06fc9f6afab0b489d8e)

## Related threats

- [openNDS heap-based buffer overflow in http_microhttpd](https://junglewise.ai/threats/cve-2026-38821-opennds-heap-based-buffer-overflow-in-http-microhttpd)
- [openNDS unauthenticated OS command injection in fas parameter](https://junglewise.ai/threats/cve-2026-38820-opennds-unauthenticated-os-command-injection-in-fas-parameter)
- [openNDS memory leak denial of service](https://junglewise.ai/threats/cve-2026-38819-opennds-memory-leak-denial-of-service)