CyberRota Analysis
AI-GeneratedThe OpenBK7231T firmware is vulnerable due to its /cfg_wifi_set endpoint, which allows configuration changes via a GET request without requiring a CSRF token. This flaw enables an attacker to exploit a one-click CSRF attack to hijack the device's WiFi settings and remove the web admin password, compromising the device's security. Organizations using this firmware should prioritize patching this vulnerability to protect against unauthorized access and configuration changes.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string.