Vulnerabilities CVE-2026-71274

CVE-2026-71274

High

Open

TLP:CLEAR

OpenBK7231T Stored XSS via Unsanitized MQTT-Set Channel Labels

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

OpenBK7231T's CHANNEL_SetLabel (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNEL_GetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/http_fns.c with no HTML encoding.

Details

CVSS Score: 8.5
EPSS Score ⓘ: 0.17%

7th percentile
CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Confidence: 90%
Published: Aug 5, 2026
Last Modified: Aug 10, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.