CVE-2026-71273: OpenBK7231T CSRF in /cfg_wifi_set Leading to Implicit Web Password Disable and WiFi Hijack
OpenBK7231T's /cfgwifiset endpoint (src/httpserver/httpfns.c) accepts configuration changes via a plain GET request with no CSRF token. If the webadminpasswordenabled parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string. A one-click CSRF payload (e.g. an <img> tag pointing at /cfgwifiset with new SSID/password parameters and webadminpasswordenabled omitted) visited by an authenticated admin's browser both hijacks the device's WiFi configuration and disables its web password protection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify /cfg_wifi_set (src/httpserver/http_fns.c) so configuration changes are not accepted via plain GET and so requests missing web_admin_password_enabled do not trigger the else-branch that silently clears the device web admin password to an empty string; reject or require CSRF token/explicit parameter presence instead.
OpenBK7231T /cfg_wifi_set endpoint CSRF protection for configuration changes (web admin password and WiFi settings) = Require a CSRF token (reject requests where web_admin_password_enabled is omitted)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71273?
CVE-2026-71273 has a medium severity score of 6.5.
What type of vulnerability is CVE-2026-71273?
CVE-2026-71273 is a Cross-Site Request Forgery (CSRF) vulnerability.
How does CVE-2026-71273 impact Web Admin Security?
CVE-2026-71273 can lead to the implicit disabling of the web admin password, allowing unauthorized access.
What is the risk associated with CVE-2026-71273?
CVE-2026-71273 has a risk score of 37, indicating a significant potential for exploitation.
How can I fix CVE-2026-71273?
To mitigate CVE-2026-71273, implement CSRF protection by requiring a CSRF token for configuration changes on the /cfg_wifi_set endpoint.