CVE-2026-71273

OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/openshwprojects/OpenBK7231T_App
https://github.com/openshwprojects/OpenBK7231T_App/blob/main/src/httpserver/http_fns.c

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) El endpoint /cfg_wifi_set de OpenBK7231T (src/httpserver/http_fns.c) acepta cambios de configuración a través de una solicitud GET simple sin token CSRF. Si el parámetro ’web_admin_password_enabled’ está ausente de la solicitud, una rama ’else’ borra silenciosamente la contraseña de administrador web del dispositivo, dejándola como una cadena vacía. Una carga útil CSRF de un solo clic (por ejemplo, una etiqueta ’[img]’ que apunta a /cfg_wifi_set con nuevos parámetros de SSID/contraseña y ’web_admin_password_enabled’ omitido), visitada por el navegador de un administrador autenticado, tanto secuestra la configuración WiFi del dispositivo como deshabilita su protección de contraseña web.

Information

Published : 2026-08-05 13:24

Updated : 2026-10-24 15:10

NVD link : CVE-2026-71273

Mitre link : CVE-2026-71273

CVE.ORG link : CVE-2026-71273

JSON object : View

Products Affected

No product.

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2026-71273", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71273", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-05T15:59:36.325597Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "affectedData": [{"vendor": "openshwprojects", "product": "OpenBK7231T_App", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "programFiles": ["src/httpserver/http_fns.c"], "defaultStatus": "unaffected"}]}], "published": "2026-08-05T13:24:51.720", "references": [{"url": "https://github.com/openshwprojects/OpenBK7231T_App", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}, {"url": "https://github.com/openshwprojects/OpenBK7231T_App/blob/main/src/httpserver/http_fns.c", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string."}, {"lang": "es", "value": "El endpoint /cfg_wifi_set de OpenBK7231T (src/httpserver/http_fns.c) acepta cambios de configuraci\u00f3n a trav\u00e9s de una solicitud GET simple sin token CSRF. Si el par\u00e1metro \u2019web_admin_password_enabled\u2019 est\u00e1 ausente de la solicitud, una rama \u2019else\u2019 borra silenciosamente la contrase\u00f1a de administrador web del dispositivo, dej\u00e1ndola como una cadena vac\u00eda. Una carga \u00fatil CSRF de un solo clic (por ejemplo, una etiqueta \u2019[img]\u2019 que apunta a /cfg_wifi_set con nuevos par\u00e1metros de SSID/contrase\u00f1a y \u2019web_admin_password_enabled\u2019 omitido), visitada por el navegador de un administrador autenticado, tanto secuestra la configuraci\u00f3n WiFi del dispositivo como deshabilita su protecci\u00f3n de contrase\u00f1a web."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}