CyberRota Analysis
AI-GeneratedThe vulnerability affects the OpenBK7231T Java implementation, specifically in the http_fn_ota_exec() function, which improperly reflects the `host` query parameter in HTML responses without adequate encoding. This flaw allows an attacker to execute arbitrary JavaScript in the browser of an authenticated admin through a crafted URL, potentially leading to session hijacking or other malicious actions. Organizations using this Java product, particularly those with web interfaces for administrative tasks, should prioritize remediation to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenBK7231T's http_fn_ota_exec() (src/httpserver/http_fns.c) reflects the `host` query parameter directly into an HTML response via hprintf255(request, "<h3>OTA requested for %s!</h3>", tmpA) with no HTML encoding, allowing a crafted URL such as /ota_exec?host=<script>alert(1)</script> to execute JavaScript in an authenticated admin's browser when they click a malicious link.