CVE-2026-71275 openshwprojects CVE debrief

Who should care

Authenticated administrators and users of OpenBK7231T deployments, as well as security teams responsible for monitoring and protecting against potential JavaScript execution attacks. These stakeholders should prioritize inventory checks, monitor for suspicious activity, and implement compensating controls to mitigate the risk of JavaScript execution via crafted URLs. Additionally, they should ensure proper security configurations and apply vendor remediation or patches when available to prevent exploitation of this vulnerability in OpenBK7231T systems.

Technical summary

OpenBK7231T's http_fn_ota_exec() function, located in src/httpserver/http_fns.c, reflects the 'host' query parameter directly into an HTML response via hprintf255() without HTML encoding. This allows a crafted URL, such as /ota_exec?host=<script>alert(1)</script>, to execute JavaScript in an authenticated admin's browser when they click a malicious link. The vulnerability is caused by the lack of proper input validation and sanitization in the http_fn_ota_exec() function. Attackers could exploit this vulnerability to perform unauthorized actions or gather sensitive information from the affected system. The affected product, OpenBK7231T, is used in various IoT and industrial control systems, making it a critical component to secure.

Defensive priority

Authenticated administrators may be vulnerable to JavaScript execution via a crafted URL; prioritize inventory checks and monitor for suspicious activity.

Recommended defensive actions

• Inventory and verify OpenBK7231T deployments for exposure
• Monitor for suspicious activity and potential JavaScript execution attempts
• Implement compensating controls, such as Web Application Firewalls (WAFs), to detect and prevent crafted URLs
• Restrict access to authenticated administrators and ensure proper security configurations
• Apply vendor remediation or patches when available

Evidence notes

The CVE description indicates that OpenBK7231T's http_fn_ota_exec() function reflects the 'host' query parameter directly into an HTML response without HTML encoding, allowing for JavaScript execution. The NVD entry is currently 5.4 MEDIUM. This issue may impact organizations using OpenBK7231T, as an authenticated administrator could be tricked into executing malicious JavaScript by clicking on a crafted link. Defenders should verify the presence of OpenBK7231T in their environment, review the official advisory for specific guidance, and monitor for suspicious activity related to JavaScript execution attempts.

Official resources