{"id":"CVE-2026-71274","published":"2026-08-05T13:24:51.850","lastModified":"2026-08-10T12:17:29.913","description":"OpenBK7231T's CHANNEL_SetLabel (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNEL_GetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/http_fns.c with no HTML encoding.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://github.com/openshwprojects/OpenBK7231T_App","tags":[]}],"exploitRefs":[{"url":"https://github.com/openshwprojects/OpenBK7231T_App","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows injection of malicious HTML content due to lack of sanitization and encoding, enabling cross-site scripting (XSS) attacks.","exploitability":"Exploitation is relatively easy if an attacker can send a crafted MQTT SetChannelLabel command; no authentication required.","blast_radius":"If exploited, the XSS attack could compromise all users viewing the rendered content, leading to data theft or manipulation.","remediation":"Implement proper HTML sanitization and encoding for user inputs before rendering them via hprintf255.","tags":["xss","html-injection","sanitization","rendering","mqtt"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T06:48:38.063Z"}}