{"id":"CVE-2026-71274","published":"2026-08-05T13:24:51.850","lastModified":"2026-08-10T12:17:29.913","description":"OpenBK7231T's CHANNEL_SetLabel (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNEL_GetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/http_fns.c with no HTML encoding.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://github.com/openshwprojects/OpenBK7231T_App","tags":[]}],"exploitRefs":[{"url":"https://github.com/openshwprojects/OpenBK7231T_App","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows an attacker to inject malicious HTML content via the MQTT SetChannelLabel command, which can lead to Cross-Site Scripting (XSS) attacks.","exploitability":"Exploitation is relatively easy given the lack of input validation and sanitization. An attacker needs to send a crafted MQTT message to the affected device.","blast_radius":"If exploited, the XSS attack could lead to unauthorized access to user sessions, data theft, or other malicious activities on the affected device and potentially on connected web interfaces.","remediation":"Disable the affected feature or restrict access to the MQTT SetChannelLabel command to prevent unauthorized input.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","mqtt","web","html-injection"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-02T08:49:43.978Z"}}