CVE-2026-71274: OpenBK7231T Stored XSS via Unsanitized MQTT-Set Channel Labels
OpenBK7231T's CHANNELSetLabel() (src/cmnds/cmdchannels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup() with no HTML sanitization. CHANNELGetLabel() returns these labels unsanitized, and they are rendered via hprintf255() at 15+ locations in src/httpserver/httpfns.c with no HTML encoding. An attacker with MQTT broker access (commonly unauthenticated in real deployments) can set a channel label containing a <script> payload that executes when any user views the device's web panel.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71274?
The severity of CVE-2026-71274 is rated as high with a score of 8.5.
How do I fix CVE-2026-71274?
To fix CVE-2026-71274, implement proper HTML sanitization on the channel labels received via the MQTT SetChannelLabel command.
What kind of vulnerability is CVE-2026-71274?
CVE-2026-71274 is a stored cross-site scripting (XSS) vulnerability due to unsanitized channel labels.
What are the potential impacts of CVE-2026-71274?
The potential impacts of CVE-2026-71274 include unauthorized script execution in the user's browser and possible data theft.
What software is affected by CVE-2026-71274?
The vulnerability CVE-2026-71274 affects the OpenBK7231T software.