CVE-2026-71275
Received Received - Intake

Stored XSS in OpenBK7231T Firmware via OTA Host Parameter

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
OpenBK7231T's http_fn_ota_exec() (src/httpserver/http_fns.c) reflects the `host` query parameter directly into an HTML response via hprintf255(request, "<h3>OTA requested for %s!</h3>", tmpA) with no HTML encoding, allowing a crafted URL such as /ota_exec?host=<script>alert(1)</script> to execute JavaScript in an authenticated admin's browser when they click a malicious link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71275
EUVD
EUVD-2026-53360

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openshwprojects openbk7231t_app *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a reflected cross-site scripting (XSS) flaw in OpenBK7231T's firmware. It occurs in the http_fn_ota_exec() function where the 'host' query parameter is directly reflected into an HTML response without proper encoding. This allows an attacker to inject malicious JavaScript code via a crafted URL, which executes when an authenticated admin views the page.

Detection Guidance

Check web server logs for suspicious OTA-related requests containing script tags or unusual host parameters. Inspect HTTP responses for unencoded user input in the OTA page. Use network monitoring tools to detect outbound connections to unexpected hosts during admin sessions.

Impact Analysis

An attacker could trick an authenticated admin into clicking a malicious link, causing arbitrary JavaScript to run in their browser. This could lead to session hijacking, unauthorized actions on the device, or theft of sensitive data like credentials or MQTT broker details.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's integrity and confidentiality principles. For HIPAA, it may expose protected health information if the device processes such data. Compliance risks include data breaches and failure to implement adequate security controls.

Mitigation Strategies

Update OpenBK7231T firmware to the latest version. Disable OTA functionality if not needed. Implement input validation to sanitize the host parameter. Use Content Security Policy headers to mitigate XSS risks. Restrict admin access to trusted networks only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71275. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart