CVE-2026-71274

Name of the Vulnerable Software and Affected Versions OpenBK7231T (affected versions not specified)

Description The software fails to sanitize channel labels received via the MQTT SetChannelLabel command in the CHANNEL SetLabel() function (src/cmnds/cmd channels.c). These labels are stored using strdup() and subsequently returned unsanitized by CHANNEL GetLabel(). The labels are then rendered via hprintf255() at over 15 locations in src/httpserver/http fns.c without HTML encoding. An attacker with access to the MQTT broker can inject a <script> payload into a channel label, which executes when a user views the device web panel. This is a stored Cross-Site Scripting (XSS) issue, where malicious scripts are permanently stored on the target server and served to other users.

Recommendations As a temporary workaround, restrict access to the MQTT broker to prevent unauthorized users from sending the SetChannelLabel command. At the moment, there is no information about a newer version that contains a fix for this vulnerability.