CVE-2026-71275
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
OpenBK7231T's http_fn_ota_exec() reflects the `host` query parameter directly into an HTML response without HTML encoding, allowing JavaScript execution in an authenticated admin's browser when they click a malicious link.
Risk Assessment
XSS attack could allow session hijacking, unauthorized actions, or data theft.
Recommendation
Apply HTML encoding for all data reflected in responses. Update OpenBK7231T to a patched version.
Other vulnerabilities in OpenBK7231T
See all- CVE-2026-71274High
The CHANNEL_SetLabel function in OpenBK7231T stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNEL_GetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/http_fns.c with no HTML encoding.
- CVE-2026-71273Medium
OpenBK7231T's /cfg_wifi_set endpoint accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string.
Original NVD description (English source)
OpenBK7231T's http_fn_ota_exec() (src/httpserver/http_fns.c) reflects the `host` query parameter directly into an HTML response via hprintf255(request, "<h3>OTA requested for %s!</h3>", tmpA) with no HTML encoding, allowing a crafted URL such as /ota_exec?host=<script>alert(1)</script> to execute JavaScript in an authenticated admin's browser when they click a malicious link.