CVE-2026-71275: OpenBK7231T XSS Vulnerability

CVE-2026-71275 Overview

CVE-2026-71275 is a reflected cross-site scripting (XSS) vulnerability in OpenBK7231T, an open source firmware for BK7231T-based IoT devices. The flaw resides in the http_fn_ota_exec() handler defined in src/httpserver/http_fns.c. The handler reflects the host query parameter into an HTML response through hprintf255(request, "<h3>OTA requested for %s!</h3>", tmpA) without HTML encoding. An attacker who tricks an authenticated administrator into clicking a crafted URL such as /ota_exec?host=<script>alert(1)</script> can execute arbitrary JavaScript in the admin's browser session. The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Arbitrary JavaScript execution in an authenticated admin browser session can lead to device configuration changes, credential theft, and hijacking of over-the-air update flows on affected IoT devices.

Affected Products

OpenBK7231T firmware (OpenBK7231T_App)
Devices flashed with the OpenBeken firmware family based on BK7231T
HTTP administration interface exposed by the http_fn_ota_exec handler

Discovery Timeline

2026-08-05 - CVE-2026-71275 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71275

Vulnerability Analysis

OpenBK7231T exposes an HTTP administration interface used to configure and update devices. The http_fn_ota_exec() function processes over-the-air (OTA) update requests received via HTTP query parameters. When the handler receives a host parameter, it copies that value into tmpA and writes it directly into the HTML response body using hprintf255(request, "<h3>OTA requested for %s!</h3>", tmpA).

The format-based write treats the attacker-controlled value as literal HTML. No output encoding, tag stripping, or context-aware escaping is applied. Any HTML markup or <script> elements supplied in the request are rendered by the administrator's browser.

Exploitation requires a valid administrator session (PR:L) and user interaction (UI:R) to visit the attacker-crafted URL. Because the resulting script executes within the origin of the device's management interface, it inherits the administrator's privileges and can invoke privileged endpoints, including OTA firmware installation, on behalf of the victim.

Root Cause

The root cause is missing output encoding in a reflection sink. The hprintf255 call uses %s formatting to embed user input directly into an HTML context, violating the principle of contextual output escaping. Any request parameter passed through this path becomes an injection point for HTML and JavaScript.

Attack Vector

An attacker delivers a malicious URL containing HTML or script payloads in the host query parameter to an authenticated administrator through phishing, chat, or a hostile web page. When the administrator visits the URL, the injected script executes in the browser and can:

Read and modify device configuration served by the admin interface
Trigger OTA update flows pointing to attacker-controlled firmware hosts
Exfiltrate session tokens, Wi-Fi credentials, and MQTT settings
Pivot to other devices reachable from the administrator's browser context

No authentication bypass is required, but the vulnerability escalates the impact of any successful phishing attempt against an operator.

Reflected XSS mechanics for this issue are documented directly in the vulnerable handler. See the OpenBK7231T_App repository for the affected src/httpserver/http_fns.c source file.

Detection Methods for CVE-2026-71275

Indicators of Compromise

HTTP requests to /ota_exec containing HTML metacharacters such as <, >, ", or script in the host parameter
Access log entries showing ota_exec?host= followed by URL-encoded payloads like %3Cscript%3E
Unexpected OTA update attempts originating from administrator IP addresses shortly after external link clicks
Outbound HTTP requests from OpenBK7231T devices to unknown firmware hosts

Detection Strategies

Inspect web server and reverse proxy logs for requests to ota_exec with non-alphanumeric characters in host
Deploy a Web Application Firewall (WAF) rule that flags XSS payload patterns targeting the OpenBK7231T admin interface
Correlate administrator browser telemetry with subsequent privileged actions on IoT management endpoints
Alert on OTA firmware downloads sourced from domains not present in an approved firmware allowlist

Monitoring Recommendations

Enable verbose HTTP logging on any reverse proxy fronting OpenBK7231T devices and retain logs for correlation
Monitor DNS resolutions initiated by IoT devices for domains referenced in OTA parameters
Track administrator authentication events and match them against subsequent parameter-based requests to /ota_exec

How to Mitigate CVE-2026-71275

Immediate Actions Required

Restrict access to the OpenBK7231T HTTP administration interface to trusted management VLANs and jump hosts
Require administrators to log out of the device UI before browsing untrusted web content
Block outbound network access from OpenBK7231T devices to arbitrary internet hosts, permitting only approved OTA sources
Educate operators to avoid clicking untrusted links that reference device management URLs

Patch Information

No fixed version is enumerated in the NVD entry at publication. Track the upstream OpenBK7231T_App repository for commits that add HTML encoding to http_fn_ota_exec() in src/httpserver/http_fns.c. Rebuild and reflash affected devices once a patched release is available.

Workarounds

Place the device management interface behind a reverse proxy that strips or encodes HTML metacharacters in query parameters
Deploy a Content Security Policy (CSP) header via the fronting proxy to disallow inline script execution on admin pages
Disable or firewall the /ota_exec endpoint when OTA updates are not actively in use

bash

# Example nginx reverse proxy configuration to block XSS payloads and enforce CSP
location /ota_exec {
    if ($args ~* "(<|%3C|script|onerror|onload)") {
        return 403;
    }
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'" always;
    add_header X-Content-Type-Options "nosniff" always;
    proxy_pass http://openbk7231t_device;
}