CVE-2026-71275

Name of the Vulnerable Software and Affected Versions OpenBK7231T (affected versions not specified)

Description The http fn ota exec() function in src/httpserver/http fns.c fails to perform HTML encoding when processing the host query parameter. This allows the parameter to be reflected directly into an HTML response via the hprintf255() function. An attacker can use a crafted URL targeting the /ota exec endpoint to execute arbitrary JavaScript in the browser of an authenticated administrator.

Recommendations As a temporary workaround, avoid using the host parameter in the /ota exec endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.