CVE-2023-38315: 
Linux Debian vulnerability analysis and mitigation

An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a try_to_authenticate NULL pointer dereference vulnerability that can be triggered with a crafted GET HTTP request missing the client token query string parameter. This vulnerability was fixed in OpenWrt master, OpenWrt 23.05, and OpenWrt 22.03 on August 28, 2023, by updating OpenNDS to version 10.1.3 (NVD, OpenNDS Release).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) with a CVSS v3.1 base score of 7.5 (HIGH). The issue occurs in the try_to_authenticate function when processing HTTP GET requests. When a request is made without the required client token query string parameter, it triggers a NULL pointer dereference condition (NVD).

When successfully exploited, this vulnerability results in crashing the OpenNDS service, leading to a Denial-of-Service (DoS) condition. This can disrupt the captive portal functionality of affected systems (NVD).

The vulnerability has been fixed in OpenNDS version 10.1.3. Users are advised to upgrade to this version or later. The fix has been incorporated into OpenWrt master, OpenWrt 23.05, and OpenWrt 22.03 branches (OpenWrt Commit).