CVE-2026-71273 openshwprojects CVE debrief

Who should care

Users of OpenBK7231T devices, administrators of networks with OpenBK7231T devices, and security teams responsible for monitoring and protecting network devices should be aware of this vulnerability. They should verify their configurations, especially regarding web admin password protection, and consider implementing additional security measures such as CSRF protection and monitoring for suspicious activity.

Technical summary

OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the `web_admin_password_enabled` parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string. A one-click CSRF payload (e.g., an <img> tag pointing at /cfg_wifi_set with new SSID/password parameters and web_admin_password_enabled omitted) visited by an authenticated admin's browser both hijacks the device's WiFi configuration and disables its web password protection. This vulnerability allows attackers to modify device configurations and reduce security.

Defensive priority

Authenticated users with access to the web interface should verify their configurations and consider implementing additional security measures.

Recommended defensive actions

• Verify and secure the web interface with proper authentication and authorization
• Implement additional security measures such as CSRF protection
• Monitor for suspicious activity on the network
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability in OpenBK7231T's /cfg_wifi_set endpoint. However, further information about the affected product and vendor is limited. Defenders should verify configurations, especially regarding web admin password protection, and monitor for suspicious activity. The absence of a CSRF token in the GET request allows for potential one-click CSRF payloads that could hijack device configurations and disable web password protection.

Official resources