CVE-2026-71274 in OpenBK7231T_App
Summary
by MITRE • 08/05/2026
OpenBK7231T's CHANNEL_SetLabel() (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup() with no HTML sanitization. CHANNEL_GetLabel() returns these labels unsanitized, and they are rendered via hprintf255() at 15+ locations in src/httpserver/http_fns.c with no HTML encoding. An attacker with MQTT broker access (commonly unauthenticated in real deployments) can set a channel label containing a <script> payload that executes when any user views the device's web panel.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability identified in OpenBK7231T represents a critical cross-site scripting flaw that stems from improper input validation and output encoding practices within the device's web interface. This weakness exists in the CHANNEL_SetLabel() function located in src/cmnds/cmd_channels.c which processes channel labels received through MQTT commands without implementing any form of HTML sanitization or encoding. The function utilizes strdup() to store these labels directly, creating a persistent vector for malicious input that can be exploited across multiple interface points.
The flaw manifests when the CHANNEL_GetLabel() function retrieves these unsanitized labels and subsequently renders them through hprintf255() calls distributed across fifteen or more locations within src/httpserver/http_fns.c. This widespread usage pattern creates numerous attack vectors where any user viewing the device's web panel could be exposed to malicious script execution. The vulnerability is particularly concerning because MQTT brokers are commonly deployed without authentication in real-world scenarios, making it trivial for attackers to gain access to the system and manipulate channel labels through the SetChannelLabel command.
This vulnerability directly maps to CWE-79 - Cross-site Scripting and aligns with ATT&CK technique T1213.002 - Data from Information Repositories, specifically targeting web application interfaces that fail to properly sanitize user input before rendering it in browser contexts. The impact extends beyond simple script execution as it represents a complete compromise of the device's web interface security model, allowing attackers to potentially steal session cookies, redirect users to malicious sites, or perform actions on behalf of authenticated users. The attack requires minimal privileges since MQTT access is typically unauthenticated in production deployments, making this vulnerability particularly dangerous for devices deployed in environments where network segmentation is insufficient.
The mitigation strategy should focus on implementing strict HTML sanitization and output encoding at multiple layers within the application architecture. All user-supplied input received through MQTT commands must be validated against a whitelist of safe characters and properly encoded before storage and rendering. The hprintf255() functions should be modified to automatically encode special HTML characters, and a centralized input validation layer should be established for all channel-related labels. Additionally, network segmentation should be enforced to restrict direct MQTT access to authorized administrators only, while implementing proper authentication mechanisms for the MQTT broker itself to prevent unauthorized modifications to device configuration parameters.