Cross-Site Scripting Vulnerability in OpenBK7231T by OpenSHW Projects
CVE-2026-71275

5.4MEDIUM

Key Information:

Vendor: OpenshWProjects
Status: Openbk7231t App
Vendor: CVE Published:; 5 August 2026

🔔 Create OpenshWProjects Vulnerability Alert

What is CVE-2026-71275?

The OpenBK7231T firmware contains a cross-site scripting vulnerability in the http_fn_ota_exec() function. This vulnerability arises from insufficient HTML encoding of the host query parameter within the HTML response, allowing an attacker to craft a malicious URL. When an authenticated administrator clicks a manipulated link, JavaScript code can be executed in their browser, potentially leading to unauthorized actions or data exposure.

Affected Version(s)

OpenBK7231T_App 0

References

https://github.com/openshwprojects/OpenBK7231T_App

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Aug 5, 2026
Vulnerability Reserved
Aug 5, 2026

Credit

Alibek Baxtiyorov

CVE-2026-71275 Data

JSON