CVE-2026-71273: openshwprojects OpenBK7231T_App · Cross-Site Request Forgery
Affects openshwprojects OpenBK7231T_AppSource CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 3 Nov 2026, 22:58 UTC
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitation evidence
Disclosed: evidence found.
CVE published 5 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 3 Nov 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| openshwprojectsOpenBK7231T_App | Affected
| Fixed in– |
AI-suggested
Until a fix is released, users should restrict access to the device's web interface to trusted networks and monitor for suspicious configuration changes. Implementing network-level protections such as firewall rules to block unauthorized access to the /cfg_wifi_set endpoint may help mitigate exploitation.
Description
OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string.