CSRF Vulnerability in OpenBK7231T WiFi Configuration

CVE-2026-71273

What is CVE-2026-71273?

The OpenBK7231T device contains a significant security flaw in its /cfg_wifi_set endpoint. This flaw allows unauthorized changes to the WiFi configuration via a simple GET request, which does not require a CSRF token. Specifically, if the request omits the 'web_admin_password_enabled' parameter, the system fails to enforce password protections, leading to potential unauthorized access. An attacker can exploit this by crafting a malicious payload that, when visited by an authenticated admin's browser, can alter the device's WiFi settings and remove its password protection, effectively compromising the device's security.

References