CVE-2026-71274

8.5 HIGHpublic exploit available

Published 2026-08-05 · Updated 2026-08-10

AI risk analysis

Summary: The flaw allows injection of malicious HTML content due to lack of sanitization and encoding, enabling cross-site scripting (XSS) attacks.
Exploitability: Exploitation is relatively easy if an attacker can send a crafted MQTT SetChannelLabel command; no authentication required.
Blast radius: If exploited, the XSS attack could compromise all users viewing the rendered content, leading to data theft or manipulation.
Prioritized remediation: Implement proper HTML sanitization and encoding for user inputs before rendering them via hprintf255.

xsshtml-injectionsanitizationrenderingmqtt

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

OpenBK7231T's CHANNEL_SetLabel (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNEL_GetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/http_fns.c with no HTML encoding.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Weaknesses

CWE-79

Public exploit & PoC references

https://github.com/openshwprojects/OpenBK7231T_App

All references

https://github.com/openshwprojects/OpenBK7231T_App

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.