CVE-2026-71273 Details
Description
OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string.
A vulnerability in the OpenBK7231T firmware's web interface allows for Cross-Site Request Forgery (CSRF) attacks. The issue arises in the '/cfg_wifi_set' endpoint, where configuration changes can be made through a standard GET request without requiring a CSRF token. If the 'web_admin_password_enabled' parameter is not included in the request, the device's web admin password is silently cleared. This vulnerability can be exploited by an authenticated admin who unknowingly visits a crafted webpage that triggers the CSRF payload, effectively hijacking the device's WiFi settings and removing its password protection.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openshwprojects/OpenBK7231T_App | TuranSec | Vendor |
| https://github.com/openshwprojects/OpenBK7231T_App/blob/main/src/httpserver/http_fns.c | TuranSec | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| OpenBK7231T | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | TuranSec |