OpenBK7231T, a component used in various IoT and industrial control systems, is vulnerable to a JavaScript execution attack. The vulnerability exists in the http_fn_ota_exec() function, which reflects the 'host' query parameter directly into an HTML response without proper encoding. This allows an attacker to craft a malicious URL that can execute JavaScript in the browser of an authenticated administrato [truncated]
An attacker with MQTT broker access can set a channel label containing a <script> payload that executes when any user views the device's web panel. OpenBK7231T's CHANNEL_SetLabel() stores channel labels received via the MQTT SetChannelLabel command using strdup() with no HTML sanitization. CHANNEL_GetLabel() returns these labels unsanitized, and they are rendered via hprintf255() at 15+ locations with no [truncated]
OpenBK7231T devices are affected by a vulnerability in the /cfg_wifi_set endpoint (src/httpserver/http_fns.c), which allows configuration changes via plain GET requests without a CSRF token. If the `web_admin_password_enabled` parameter is absent, the device's web admin password is silently cleared to an empty string. This issue enables one-click CSRF payloads (e.g., an <img> tag pointing at /cfg_wifi_set [truncated]
