EUVD-2026-53358
GHSA-hxw9-fq53-ph7w
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-reachable endpoint exploited through browser (AV:N, PR:N), requires admin to visit attacker page (UI:R), and impact is integrity-only - credentials overwritten but not disclosed.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
1DescriptionCVE.org
OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the web_admin_password_enabled parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string. A one-click CSRF payload (e.g. an <img> tag pointing at /cfg_wifi_set with new SSID/password parameters and web_admin_password_enabled omitted) visited by an authenticated admin's browser both hijacks the device's WiFi configuration and disables its web password protection.
AnalysisAI
Cross-site request forgery in OpenBK7231T firmware's /cfg_wifi_set endpoint allows a remote attacker to simultaneously hijack a device's WiFi credentials and silently disable its web admin password protection via a single malicious HTTP GET request triggered in an authenticated admin's browser. The vulnerability is compounded by a logic flaw: omitting the web_admin_password_enabled parameter from the CSRF request causes an else-branch to clear the admin password entirely, leaving the device fully open. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Technical ContextAI
OpenBK7231T App is an open-source alternative firmware for the BK7231T SoC, widely used in Tuya-compatible smart home devices. The vulnerable endpoint /cfg_wifi_set, located in src/httpserver/http_fns.c, processes WiFi configuration changes over plain HTTP GET requests. The root cause is CWE-352 (Cross-Site Request Forgery): the endpoint enforces no CSRF token, no Origin/Referer validation, and no state-changing method restriction (it responds to GET rather than requiring POST). A secondary logic defect compounds the CSRF: when the web_admin_password_enabled parameter is absent - as it would be in a minimal CSRF payload - a missing parameter results in the admin password being cleared to an empty string rather than preserved. The affected CPE cpe:2.3:a:openshwprojects:openbk7231t_app:*:*:*:*:*:*:*:* covers all tracked versions.
RemediationAI
No vendor-released patch version has been confirmed in the available data; the upstream code reference points to the live repository at https://github.com/openshwprojects/OpenBK7231T_App/blob/main/src/httpserver/http_fns.c, but no tagged fix release is identified. Users should monitor the project repository for a commit that adds CSRF token validation to /cfg_wifi_set and corrects the else-branch logic that clears the admin password. As immediate compensating controls: restrict access to the device's web interface to a trusted VLAN or isolated IoT network segment to prevent cross-origin browser requests from reaching the endpoint - this eliminates the network path required for CSRF exploitation but does not fix the underlying flaw. Ensure the admin web interface is not reachable from guest or untrusted networks, as this removes the attacker's ability to trigger cross-site requests. Avoid browsing untrusted sites while authenticated to the device's web interface. Note that network segmentation does not remediate the missing CSRF token or the password-clearing logic defect.
More in Openbk7231T App
View allStored XSS in OpenBK7231T firmware allows an adjacent-network attacker with MQTT broker access - commonly unauthenticate
Reflected XSS in OpenBK7231T firmware's OTA update endpoint exposes authenticated admins to JavaScript injection via a c
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today