EUVD-2026-53360
GHSA-2qcv-j8w9-9r25
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (TuranSec) · only source for this CVE.
CVSS VectorVendor: TuranSec
Lifecycle Timeline
1DescriptionCVE.org
OpenBK7231T's http_fn_ota_exec() (src/httpserver/http_fns.c) reflects the host query parameter directly into an HTML response via hprintf255(request, "<h3>OTA requested for %s!</h3>", tmpA) with no HTML encoding, allowing a crafted URL such as /ota_exec?host=<script>alert(1)</script> to execute JavaScript in an authenticated admin's browser when they click a malicious link.
AnalysisAI
Reflected XSS in OpenBK7231T firmware's OTA update endpoint exposes authenticated admins to JavaScript injection via a crafted link. The /ota_exec handler in src/httpserver/http_fns.c echoes the host query parameter verbatim into an HTML response using hprintf255(), without HTML encoding, enabling an attacker to run arbitrary script in the admin's browser session. No public exploit code or CISA KEV listing exists at time of analysis; EPSS data was not provided.
More in Openbk7231T App
View allStored XSS in OpenBK7231T firmware allows an adjacent-network attacker with MQTT broker access - commonly unauthenticate
Cross-site request forgery in OpenBK7231T firmware's /cfg_wifi_set endpoint allows a remote attacker to simultaneously h
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today