The OpenBK7231T_App's http_fn_ota_exec() function (located in src/httpserver/http_fns.c) improperly handles the 'host' query parameter by reflecting it directly into an HTML response using hprintf255(request, "<h3>OTA requested for %s!</h3>", tmpA) without HTML encoding. This lack of encoding enables a stored or reflected cross-site scripting (CWE-79) attack vector. An attacker can craft a URL such as /ota_exec?host=<script>alert(1)</script> that, when visited by an authenticated administrator, executes arbitrary JavaScript in their browser context. This vulnerability requires user interaction (clicking the malicious link) and privileges of an authenticated admin user.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an authenticated administrator's browser. This can lead to information disclosure or manipulation of the admin interface, but does not directly impact system availability. The CVSS vector indicates network attack vector, low attack complexity, requires privileges and user interaction, with partial confidentiality and integrity impact and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking untrusted links containing the 'host' parameter in the OTA execution URL. Implementing input validation or HTML encoding on the 'host' parameter before rendering it in the response is recommended once a patch is released.