Description

A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon (denial of service) and potentially achieve remote code execution. This is in http_microhttpd.c.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-28T02:16:21.490Z",
  "pubdate": "2026-08-28T02:16:21.490Z",
  "executiveSummary": "A critical heap-based buffer overflow vulnerability has been identified in openNDS versions prior to 11.0.0. The vulnerability resides within the http_microhttpd.c component, which handles incoming HTTP requests on the captive portal.\nAn unauthenticated attacker positioned on the captive portal network can exploit this flaw by sending specifically crafted HTTP requests to the openNDS daemon. Successful exploitation leads to a denial of service (DoS) through process termination or, more critically, may facilitate remote code execution (RCE) with the privileges of the daemon.\nGiven that the daemon typically operates with elevated privileges to manage network traffic and firewall rules, this vulnerability poses a severe risk to system integrity. The attack requires no prior authentication, as the vulnerable code path is accessible via the network interface used for captive portal redirection. This flaw highlights a significant weakness in memory safety during the request parsing phase of the daemon, necessitating immediate attention to patching or hardening configurations to prevent unauthorized code execution or service disruption.",
  "technicalDetails": "The vulnerability is localized within the http_microhttpd.c file, which serves as the core request processing engine for the openNDS daemon. The flaw manifests as a heap-based buffer overflow during the handling of HTTP request headers or body content. When the daemon receives an incoming request, the memory allocation and copying routines within this component fail to sufficiently validate the size of input data against the allocated heap buffer.\nThe root cause involves improper bounds checking when transferring data into memory buffers during the parsing of HTTP requests. Because openNDS is designed to intercept and process traffic before a user has authenticated against the captive portal, the processing logic operates in a state where it must handle potentially malicious input from arbitrary unauthenticated sources. An attacker can craft a sequence of HTTP requests containing oversized headers or payload segments that exceed the memory limits of the statically or dynamically sized buffers allocated on the heap.\nThe exploitation flow begins with the attacker sending a malformed HTTP request to the openNDS service. As the http_microhttpd.c component processes the request, the overflow occurs, allowing the attacker to overwrite adjacent data structures on the heap. In a DoS scenario, the attacker corrupts internal control structures, causing the process to enter an inconsistent state and subsequently crash. In an RCE scenario, the attacker leverages the heap corruption to overwrite function pointers, heap-based metadata, or return addresses, redirecting execution flow to attacker-supplied shellcode embedded within the malformed request.\nBecause the daemon runs with root or other high-level system privileges to manipulate iptables or nftables, successful exploitation grants the attacker significant control over the underlying device. The vulnerability does not require authentication, as the listener is exposed to the captive portal network segment by design. Memory safety issues of this nature often allow for bypasses of standard exploit mitigations, particularly if the memory management implementation lacks robust heap hardening (such as canaries or integrity checks). The impact is exacerbated by the daemon's direct interaction with the network stack, making it an ideal vector for attackers attempting to gain persistent access to captive portal hardware, such as routers or IoT gateways."
}