CVE-2026-71273

{
  "id": "CVE-2026-71273",
  "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
  "published": "2026-08-05T13:24:51.720",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string."
    },
    {
      "lang": "es",
      "value": "El endpoint /cfg_wifi_set de OpenBK7231T (src/httpserver/http_fns.c) acepta cambios de configuración a través de una solicitud GET simple sin token CSRF. Si el parámetro ’web_admin_password_enabled’ está ausente de la solicitud, una rama ’else’ borra silenciosamente la contraseña de administrador web del dispositivo, dejándola como una cadena vacía. Una carga útil CSRF de un solo clic (por ejemplo, una etiqueta ’[img]’ que apunta a /cfg_wifi_set con nuevos parámetros de SSID/contraseña y ’web_admin_password_enabled’ omitido), visitada por el navegador de un administrador autenticado, tanto secuestra la configuración WiFi del dispositivo como deshabilita su protección de contraseña web."
    }
  ],
  "affected": [
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "affectedData": [
        {
          "vendor": "openshwprojects",
          "product": "OpenBK7231T_App",
          "defaultStatus": "unaffected",
          "programFiles": [
            "src/httpserver/http_fns.c"
          ],
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "*",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-05T15:59:36.325597Z",
          "id": "CVE-2026-71273",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/openshwprojects/OpenBK7231T_App",
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
    },
    {
      "url": "https://github.com/openshwprojects/OpenBK7231T_App/blob/main/src/httpserver/http_fns.c",
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
    }
  ]
}