OpenBK7231T’s /cfg_wifi_set endpoint accepts configuration changes via a plain GET request and lacks a CSRF token. When a required parameter is missing, the code silently clears the device’s web admin password to an empty string. This defect allows an attacker to craft a single click CSRF request that, if an authenticated administrator’s browser loads the URL, disables web authentication completely. The result is that an attacker can subsequently configure the device without any credential, enabling unauthorized changes or further exploitation. This behavior is a classic Cross‑Site Request Forgery (CWE‑352) that removes a security boundary around the web interface.

openhwprojects:OpenBK7231T_App. The vulnerability is present in the OpenBK7231T application firmware that includes the http_fns.c implementation of /cfg_wifi_set. No specific firmware version information is provided, so all releases that include this code are potentially affected.

The CVSS score of 6.5 indicates a moderate risk level, while the EPSS score of <1% shows a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack likely requires the victim to be an authenticated administrator with a logged‑in browser, a condition that is inferred from the description. An attacker would need to lure that client to visit a malicious URL, making the exploit dependent on social‑engineering success. Nonetheless, once the web admin password is cleared, the device’s web interface becomes fully open, creating a high‑impact scenario for those who succeed in executing the CSRF.