CVE-2026-71274 Details

A cross-site scripting vulnerability has been identified in OpenBK7231T firmware, specifically within the channel label management via MQTT. The issue arises in the CHANNEL_SetLabel() function, where labels are stored using strdup() without proper HTML sanitization. Consequently, the unsanitized labels are retrieved by CHANNEL_GetLabel() and displayed through hprintf255() at over 15 locations in the HTTP server code, also lacking HTML encoding. This flaw allows an attacker with access to the MQTT broker, which is often unauthenticated in real-world scenarios, to inject a <script> payload into a channel label. When viewed on the device's web panel, the injected script executes, demonstrating a clear cross-site scripting vulnerability.