CVE-2026-71274 — OpenBK7231T Stored XSS via Unsanitized MQTT-Set Channel Labels

CVE-2026-71274

OpenBK7231T Stored XSS via Unsanitized MQTT-Set Channel Labels PUBLISHED

Description (CNA)

OpenBK7231T's CHANNEL_SetLabel (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNEL_GetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/http_fns.c with no HTML encoding.

Affected (CNA)

Vendor / product	Versions
openshwprojects / OpenBK7231T_App	affected 0 through *

CWE

CWE-79

References

https://github.com/openshwprojects/OpenBK7231T_App

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.