CVE-2026-71273 Overview
CVE-2026-71273 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the OpenBK7231T firmware's /cfg_wifi_set HTTP endpoint. The endpoint accepts configuration changes through plain GET requests without any CSRF token validation. When the web_admin_password_enabled parameter is omitted from a request, an else-branch in the handler silently clears the device's web admin password to an empty string. An attacker can craft a one-click payload that hijacks the device's WiFi configuration and disables password protection when an authenticated administrator visits an attacker-controlled page.
Critical Impact
A single crafted request viewed by an authenticated admin can rewrite WiFi credentials and remove web admin authentication on affected OpenBK7231T devices.
Affected Products
- OpenBK7231T Application firmware
- Devices running the vulnerable src/httpserver/http_fns.c handler
- IoT devices flashed with OpenBK7231T builds exposing /cfg_wifi_set
Discovery Timeline
- 2026-08-05 - CVE-2026-71273 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-71273
Vulnerability Analysis
The /cfg_wifi_set endpoint in src/httpserver/http_fns.c processes device configuration through unauthenticated-style GET requests. The handler reads WiFi SSID, WiFi password, and administrative flags directly from query-string parameters. No anti-CSRF token, custom header requirement, or SameSite cookie enforcement guards the state-changing operation.
Because the endpoint accepts GET requests, browsers automatically issue the request when loading embedded resources such as <img> tags. Any authenticated admin session cookie is attached by the browser, allowing a remote page to trigger configuration changes on the local device.
The handler treats the web_admin_password_enabled parameter as a boolean feature flag. When the parameter is present, the handler updates the flag as expected. When the parameter is absent, an else-branch executes and writes an empty string into the web admin password field, effectively disabling authentication for the management interface.
Root Cause
The root cause is a combination of two design flaws. First, the endpoint performs state-changing operations over GET without CSRF protection. Second, the handler conflates "parameter omitted" with "disable password," so any request that does not carry the flag silently clears the credential.
Attack Vector
An attacker hosts a page containing an <img> tag or fetch call whose src points to the target device at /cfg_wifi_set with attacker-chosen SSID and password parameters and no web_admin_password_enabled parameter. When an authenticated administrator visits the page, the browser sends the request to the device on the local network. The device updates WiFi settings to attacker-controlled values and clears the admin password. The attacker then reconnects the device to a network they control and logs in without credentials.
Refer to the OpenBK7231T HTTP Functions Source for the vulnerable handler implementation.
Detection Methods for CVE-2026-71273
Indicators of Compromise
- Web admin password field observed as empty after an unexpected configuration change on OpenBK7231T devices.
- Device WiFi SSID or credentials changed without an administrator-initiated action.
- HTTP access logs showing GET /cfg_wifi_set requests with a Referer header pointing to an external or untrusted origin.
Detection Strategies
- Inspect proxy and network logs for requests to /cfg_wifi_set originating from browsers rather than management workstations.
- Alert on GET requests to device management endpoints that carry cross-origin Referer or Origin headers.
- Monitor device configuration state for transitions of web_admin_password_enabled to disabled or an empty password hash.
Monitoring Recommendations
- Capture and retain HTTP request logs from IoT management VLANs for retrospective analysis.
- Baseline expected /cfg_wifi_set request volumes and alert on deviations.
- Correlate DNS and network flow data for OpenBK7231T devices to detect unexpected SSID reassociation events.
How to Mitigate CVE-2026-71273
Immediate Actions Required
- Isolate OpenBK7231T devices on a segmented management VLAN unreachable from user browsing networks.
- Restrict administrator workflows so device management is performed from dedicated browsers or hosts that never visit untrusted sites.
- Audit /cfg_wifi_set handling in deployed firmware builds and confirm current web_admin_password_enabled state on every device.
Patch Information
No vendor patch identifier is listed in the NVD entry at publication. Track the upstream project at the OpenBK7231T Application repository for fixes that add CSRF token validation, require POST for state-changing endpoints, and remove the else-branch that clears the admin password when the flag is omitted.
Workarounds
- Place OpenBK7231T devices behind a reverse proxy that enforces CSRF tokens and rejects cross-origin Referer headers.
- Block outbound routing from IoT management interfaces so browsers on user endpoints cannot reach device HTTP servers directly.
- Disable or firewall the HTTP admin interface when not actively in use.
# Example iptables rule restricting device admin access to a management host
iptables -A INPUT -p tcp --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
