CSRF Lets Attackers Disable Web Password in OpenBK7231T

Executive Summary

This vulnerability is in OpenBK7231T's /cfg_wifi_set endpoint. It allows configuration changes via a plain GET request without a CSRF token. If the web_admin_password_enabled parameter is missing, the device's web admin password is silently cleared. An attacker can exploit this with a one-click CSRF payload, such as an image tag, to hijack WiFi settings and disable password protection.

Useful 0 Not Useful 0

Detection Guidance

Check if your OpenBK7231T device accepts GET requests to /cfg_wifi_set without requiring a CSRF token. Use a browser or curl to send a GET request omitting the web_admin_password_enabled parameter and verify if the admin password is cleared.

Useful 0 Not Useful 0

Impact Analysis

An attacker could take control of your device's WiFi configuration and remove its web password protection. This could allow unauthorized access to your network, interception of traffic, or further attacks on connected devices. The attack requires an authenticated admin to visit a malicious link.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to device configuration, potentially exposing sensitive network credentials or disabling security controls. For GDPR, it may violate data protection principles by allowing unauthorized changes to device settings. For HIPAA, it could compromise the integrity of networked medical devices if WiFi credentials are exposed.

Useful 0 Not Useful 0

Mitigation Strategies

Disable GET requests for /cfg_wifi_set and enforce POST requests with CSRF tokens. Update the firmware to a patched version if available. Restrict network access to the device's admin interface.

Useful 0 Not Useful 0