The OpenBK7231T_App's http_fn_ota_exec() function (located in src/httpserver/http_fns.c) improperly handles the 'host' query parameter by reflecting it directly into an HTML response via hprintf255(request, "<h3>OTA requested for %s!</h3>", tmpA) without any HTML encoding or sanitization. This lack of encoding enables an attacker to craft a URL such as /ota_exec?host=<script>alert(1)</script> that, when clicked by an authenticated administrator, executes arbitrary JavaScript in their browser context, constituting a reflected cross-site scripting (CWE-79) vulnerability. The vulnerability requires low attack complexity, network access, and privileges of an authenticated user with UI interaction. The impact includes limited confidentiality and integrity loss but no availability impact.

An attacker can execute arbitrary JavaScript code in the browser of an authenticated admin user by tricking them into clicking a maliciously crafted URL. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions within the admin interface. There is no direct impact on system availability. The vulnerability requires the victim to be an authenticated user and to interact with the malicious link.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, administrators should avoid clicking untrusted links containing the 'host' parameter in the OTA execution endpoint. Implementing input validation or HTML encoding on the 'host' parameter in the application code would mitigate this issue once a patch is released.