CVE-2026-71273 in OpenBK7231T_App
Summary
by MITRE • 08/05/2026
OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the `web_admin_password_enabled` parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string. A one-click CSRF payload (e.g. an <img> tag pointing at /cfg_wifi_set with new SSID/password parameters and web_admin_password_enabled omitted) visited by an authenticated admin's browser both hijacks the device's WiFi configuration and disables its web password protection.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability resides in the OpenBK7231T IoT device firmware where the /cfg_wifi_set endpoint demonstrates a critical security flaw through improper input validation and authentication handling. The endpoint accepts configuration changes via unauthenticated plain GET requests, which violates fundamental web security principles and creates a dangerous attack surface. The implementation lacks any form of CSRF protection mechanisms such as anti-CSRF tokens or origin validation, making it susceptible to cross-site request forgery attacks that can be executed through simple HTML tags.
The technical flaw manifests in the conditional logic processing of the web_admin_password_enabled parameter within the HTTP handler function. When this specific parameter is absent from the incoming GET request, the code executes an else-branch that silently resets the device's web admin password to an empty string without any user confirmation or authentication verification. This behavior creates a dangerous privilege escalation vector where unauthorized attackers can manipulate device configuration parameters through crafted malicious payloads. The vulnerability aligns with CWE-352 Cross-Site Request Forgery and CWE-287 Improper Authentication, as it allows for unauthorized administrative actions without proper authentication checks.
The operational impact of this vulnerability is severe for IoT environments where devices may be deployed in sensitive locations such as industrial control systems, smart buildings, or network infrastructure. An attacker could exploit this vulnerability by crafting a one-click CSRF payload using an image tag that points to the vulnerable endpoint with modified SSID and password parameters while omitting the web_admin_password_enabled flag. When an authenticated administrator visits a malicious webpage containing this payload, their browser automatically executes the request without their knowledge, resulting in both WiFi configuration changes and complete removal of web-based administrative protection. This creates a persistent backdoor access point that can be used for further attacks within the network.
The attack vector leverages the principle of implicit trust within browser environments and demonstrates how modern web applications must implement comprehensive security controls beyond simple authentication mechanisms. According to ATT&CK framework, this vulnerability maps to T1566 Initial Access through malicious HTML content and T1078 Valid Accounts for maintaining persistent access after privilege escalation. Organizations should implement immediate mitigations including mandatory CSRF token validation, proper request method enforcement, and input sanitization across all configuration endpoints. The device firmware should enforce authentication verification for all administrative operations and reject any parameter changes that could compromise system security without explicit user consent. Additionally, network segmentation and monitoring should be implemented to detect unauthorized configuration changes and unusual traffic patterns that may indicate exploitation attempts.