CVE-2026-71274
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The CHANNEL_SetLabel function in OpenBK7231T stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNEL_GetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/http_fns.c with no HTML encoding.
Risk Assessment
Lack of HTML sanitization may lead to stored XSS attacks, allowing malicious script execution in an administrator's browser.
Recommendation
Add HTML encoding to channel labels before rendering and sanitize input in CHANNEL_SetLabel.
Other vulnerabilities in OpenBK7231T
See all- CVE-2026-71275Medium
OpenBK7231T's http_fn_ota_exec() reflects the `host` query parameter directly into an HTML response without HTML encoding, allowing JavaScript execution in an authenticated admin's browser when they click a malicious link.
- CVE-2026-71273Medium
OpenBK7231T's /cfg_wifi_set endpoint accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string.
Original NVD description (English source)
OpenBK7231T's CHANNEL_SetLabel (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNEL_GetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/http_fns.c with no HTML encoding.