Openshwprojects
Monthly
Stored XSS in OpenBK7231T firmware allows an adjacent-network attacker with MQTT broker access - commonly unauthenticated in real IoT deployments - to inject persistent JavaScript payloads into device channel labels via the SetChannelLabel MQTT command. The malicious label survives device reboots in memory and executes in the browser of every user who subsequently views the device's built-in web management panel, with high confidentiality and integrity impact in a changed scope. No public exploit has been identified at time of analysis, but the unauthenticated MQTT broker pattern common in home automation environments effectively lowers the practical exploitation barrier below what the AV:A vector alone implies.
Reflected XSS in OpenBK7231T firmware's OTA update endpoint exposes authenticated admins to JavaScript injection via a crafted link. The `/ota_exec` handler in `src/httpserver/http_fns.c` echoes the `host` query parameter verbatim into an HTML response using `hprintf255()`, without HTML encoding, enabling an attacker to run arbitrary script in the admin's browser session. No public exploit code or CISA KEV listing exists at time of analysis; EPSS data was not provided.
Cross-site request forgery in OpenBK7231T firmware's /cfg_wifi_set endpoint allows a remote attacker to simultaneously hijack a device's WiFi credentials and silently disable its web admin password protection via a single malicious HTTP GET request triggered in an authenticated admin's browser. The vulnerability is compounded by a logic flaw: omitting the `web_admin_password_enabled` parameter from the CSRF request causes an else-branch to clear the admin password entirely, leaving the device fully open. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Stored XSS in OpenBK7231T firmware allows an adjacent-network attacker with MQTT broker access - commonly unauthenticated in real IoT deployments - to inject persistent JavaScript payloads into device channel labels via the SetChannelLabel MQTT command. The malicious label survives device reboots in memory and executes in the browser of every user who subsequently views the device's built-in web management panel, with high confidentiality and integrity impact in a changed scope. No public exploit has been identified at time of analysis, but the unauthenticated MQTT broker pattern common in home automation environments effectively lowers the practical exploitation barrier below what the AV:A vector alone implies.
Reflected XSS in OpenBK7231T firmware's OTA update endpoint exposes authenticated admins to JavaScript injection via a crafted link. The `/ota_exec` handler in `src/httpserver/http_fns.c` echoes the `host` query parameter verbatim into an HTML response using `hprintf255()`, without HTML encoding, enabling an attacker to run arbitrary script in the admin's browser session. No public exploit code or CISA KEV listing exists at time of analysis; EPSS data was not provided.
Cross-site request forgery in OpenBK7231T firmware's /cfg_wifi_set endpoint allows a remote attacker to simultaneously hijack a device's WiFi credentials and silently disable its web admin password protection via a single malicious HTTP GET request triggered in an authenticated admin's browser. The vulnerability is compounded by a logic flaw: omitting the `web_admin_password_enabled` parameter from the CSRF request causes an else-branch to clear the admin password entirely, leaving the device fully open. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.