CVE-2026-71273
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
OpenBK7231T's /cfg_wifi_set endpoint accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string.
Risk Assessment
An attacker can exploit CSRF to change Wi-Fi configuration and clear the admin password, potentially leading to unauthorized access to the device and full control.
Recommendation
Add CSRF token validation for the /cfg_wifi_set endpoint and avoid silently clearing the password when the parameter is missing.
Other vulnerabilities in OpenBK7231T
See all- CVE-2026-71275Medium
OpenBK7231T's http_fn_ota_exec() reflects the `host` query parameter directly into an HTML response without HTML encoding, allowing JavaScript execution in an authenticated admin's browser when they click a malicious link.
- CVE-2026-71274High
The CHANNEL_SetLabel function in OpenBK7231T stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNEL_GetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/http_fns.c with no HTML encoding.
Original NVD description (English source)
OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string.