CVE-2026-71275

OpenBK7231T's httpfnotaexec src/httpserver/httpfns.c reflects the host query parameter directly into an HTML response via hprintf255request, "OTA requested for %s!", tmpA with no HTML encoding, allowing a crafted URL such as /otaexec?host=alert1 to execute JavaScript in an authenticated admin's...

CVE-2026-71273

OpenBK7231T's /cfgwifiset endpoint src/httpserver/httpfns.c accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string...

CVE-2026-71274

OpenBK7231T's CHANNELSetLabel src/cmnds/cmdchannels.c stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNELGetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/httpfns.c wit...

CVE-2026-71275 OpenBK7231T - Reflected XSS via OTA host Parameter

OpenBK7231T's httpfnotaexec src/httpserver/httpfns.c reflects the host query parameter directly into an HTML response via hprintf255request, "OTA requested for %s!", tmpA with no HTML encoding, allowing a crafted URL such as /otaexec?host=alert1 to execute JavaScript in an authenticated admin's...

CVE-2026-71275

OpenBK7231T vulnerability CVE-2026-71275: The function http_fn_ota_exec() in src/httpserver/http_fns.c reflects the host query parameter directly into an HTML response via hprintf255, without HTML encoding. A crafted URL like /ota_exec?host= can lead to JavaScript execution in an authenticated ad...

EUVD-2026-53360

OpenBK7231T's httpfnotaexec src/httpserver/httpfns.c reflects the host query parameter directly into an HTML response via hprintf255request, "OTA requested for %s!", tmpA with no HTML encoding, allowing a crafted URL such as /otaexec?host=alert1 to execute JavaScript in an authenticated admin's...

CVE-2026-71275 OpenBK7231T - Reflected XSS via OTA host Parameter

OpenBK7231T's httpfnotaexec src/httpserver/httpfns.c reflects the host query parameter directly into an HTML response via hprintf255request, "OTA requested for %s!", tmpA with no HTML encoding, allowing a crafted URL such as /otaexec?host=alert1 to execute JavaScript in an authenticated admin's...

CVE-2026-71274 OpenBK7231T Stored XSS via Unsanitized MQTT-Set Channel Labels

OpenBK7231T's CHANNELSetLabel src/cmnds/cmdchannels.c stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNELGetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/httpfns.c wit...

CVE-2026-71274

OpenBK7231T's CHANNELSetLabel src/cmnds/cmdchannels.c stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNELGetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/httpfns.c wit...

CVE-2026-71274 OpenBK7231T Stored XSS via Unsanitized MQTT-Set Channel Labels

OpenBK7231T's CHANNELSetLabel src/cmnds/cmdchannels.c stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNELGetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/httpfns.c wit...

CVE-2026-71274

OpenBK7231T is affected by CVE-2026-71274 due to CHANNEL_SetLabel() storing labels from MQTT SetChannelLabel without HTML sanitization, and CHANNEL_GetLabel() returning unsanitized values. These labels are rendered via hprintf255() in the web panel at 15+ locations with no HTML encoding, enabling...

CVE-2026-71273 OpenBK7231T CSRF in /cfg_wifi_set Leading to Implicit Web Password Disable and WiFi Hijack

OpenBK7231T's /cfgwifiset endpoint src/httpserver/httpfns.c accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string...

CVE-2026-71273 OpenBK7231T CSRF in /cfg_wifi_set Leading to Implicit Web Password Disable and WiFi Hijack

OpenBK7231T's /cfgwifiset endpoint src/httpserver/httpfns.c accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string...

CVE-2026-71273

OpenBK7231T firmware exposes a CSRF flaw in the /cfg_wifi_set endpoint: configuration changes are accepted via an unauthenticated GET request without a CSRF token. If the web_admin_password_enabled parameter is omitted, an else-branch silently clears the device’s web admin password to an empty st...

CVE-2026-71273

OpenBK7231T's /cfgwifiset endpoint src/httpserver/httpfns.c accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string...

CVE-2026-71273: Cross-Site Request Forgery (CSRF)

OpenBK7231T's /cfgwifiset endpoint src/httpserver/httpfns.c accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string...

CVE-2026-71274: Improper Neutralization of Input During Web Page Generation

OpenBK7231T's CHANNELSetLabel src/cmnds/cmdchannels.c stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNELGetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/httpfns.c wit...

CVE-2026-71275: Improper Neutralization of Input During Web Page Generation

OpenBK7231T's httpfnotaexec src/httpserver/httpfns.c reflects the host query parameter directly into an HTML response via hprintf255request, " OTA requested for %s! ", tmpA with no HTML encoding, allowing a crafted URL such as /otaexec?host= to execute JavaScript in an authenticated admin's brows...