CVE-2026-71273

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71273", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-05T12:23:34.967Z", "datePublished": "2026-08-05T12:26:20.275Z", "dateUpdated": "2026-08-10T11:46:50.240Z"}, "containers": {"cna": {"title": "OpenBK7231T CSRF in /cfg_wifi_set Leading to Implicit Web Password Disable and WiFi Hijack", "descriptions": [{"lang": "en", "value": "OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string.</p>"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352", "cweId": "CWE-352", "type": "CWE"}]}], "affected": [{"vendor": "openshwprojects", "product": "OpenBK7231T_App", "programFiles": ["src/httpserver/http_fns.c"], "versions": [{"version": "0", "lessThanOrEqual": "*", "status": "affected", "versionType": "custom"}], "defaultStatus": "unaffected"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}}], "references": [{"url": "https://github.com/openshwprojects/OpenBK7231T_App", "tags": ["third-party-advisory"]}, {"url": "https://github.com/openshwprojects/OpenBK7231T_App/blob/main/src/httpserver/http_fns.c", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Alibek Baxtiyorov", "type": "finder"}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:46:50.240Z"}, "source": {"discovery": "EXTERNAL"}, "datePublic": "2026-08-05T12:26:20.275Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T15:59:36.325597Z", "id": "CVE-2026-71273", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T15:59:42.854Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71273", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-05T15:59:36.325597Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T15:59:39.002Z"}}], "cna": {"title": "OpenBK7231T CSRF in /cfg_wifi_set Leading to Implicit Web Password Disable and WiFi Hijack", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Alibek Baxtiyorov"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "openshwprojects", "product": "OpenBK7231T_App", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "programFiles": ["src/httpserver/http_fns.c"], "defaultStatus": "unaffected"}], "datePublic": "2026-08-05T12:26:20.275Z", "references": [{"url": "https://github.com/openshwprojects/OpenBK7231T_App", "tags": ["third-party-advisory"]}, {"url": "https://github.com/openshwprojects/OpenBK7231T_App/blob/main/src/httpserver/http_fns.c", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string.", "supportingMedia": [{"type": "text/html", "value": "<p>OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:46:50.240Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71273", "state": "PUBLISHED", "dateUpdated": "2026-08-10T11:46:50.240Z", "dateReserved": "2026-08-05T12:23:34.967Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-05T12:26:20.275Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "OpenBK7231T_App", "programFiles": ["src/httpserver/http_fns.c"], "vendor": "openshwprojects", "versions": [{"lessThanOrEqual": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string."}, {"lang": "es", "value": "El endpoint /cfg_wifi_set de OpenBK7231T (src/httpserver/http_fns.c) acepta cambios de configuraci\u00f3n a trav\u00e9s de una solicitud GET simple sin token CSRF. Si el par\u00e1metro \u2019web_admin_password_enabled\u2019 est\u00e1 ausente de la solicitud, una rama \u2019else\u2019 borra silenciosamente la contrase\u00f1a de administrador web del dispositivo, dej\u00e1ndola como una cadena vac\u00eda. Una carga \u00fatil CSRF de un solo clic (por ejemplo, una etiqueta \u2019[img]\u2019 que apunta a /cfg_wifi_set con nuevos par\u00e1metros de SSID/contrase\u00f1a y \u2019web_admin_password_enabled\u2019 omitido), visitada por el navegador de un administrador autenticado, tanto secuestra la configuraci\u00f3n WiFi del dispositivo como deshabilita su protecci\u00f3n de contrase\u00f1a web."}], "id": "CVE-2026-71273", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71273", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-05T15:59:36.325597Z", "version": "2.0.3"}}]}, "published": "2026-08-05T13:24:51.720", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/openshwprojects/OpenBK7231T_App"}, {"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/openshwprojects/OpenBK7231T_App/blob/main/src/httpserver/http_fns.c"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "OpenBK7231T_App", "source": "cna", "vendor": "openshwprojects"}, "product": "openbk7231t_app", "vendor": "openshwprojects"}], "created": "2026-08-05T15:00:05.509245+00:00", "updated": "2026-08-10T21:30:04.095362+00:00", "vendors": ["openshwprojects", "openshwprojects$PRODUCT$openbk7231t_app"]}