{"id":"CVE-2026-71274","aliases":["EUVD-2026-53359","GHSA-9c86-c5c2-55cr"],"status":"published","title":"OpenBK7231T Stored XSS via Unsanitized MQTT-Set Channel Labels","description":"OpenBK7231T's CHANNEL_SetLabel (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNEL_GetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/http_fns.c with no HTML encoding.","severity":{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00281,"percentile":0.20762,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-08-05T12:26:21Z","modified":"2026-10-24T15:10:00Z","products":[{"vendor":"openshwprojects","product":"openbk7231t_app"}],"references":[{"url":"https://github.com/openshwprojects/OpenBK7231T_App","tags":["third-party-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71274"},{"url":"https://github.com/advisories/GHSA-9c86-c5c2-55cr"}],"sources":{"cve":[{"id":"CVE-2026-71274","title":"OpenBK7231T Stored XSS via Unsanitized MQTT-Set Channel Labels","description":"OpenBK7231T's CHANNEL_SetLabel (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNEL_GetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/http_fns.c with no HTML encoding.","status":"published","published":"2026-08-05T12:26:21.16Z","modified":"2026-08-10T11:46:52.287Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:19:49.559463Z"}],"euvd":[{"id":"EUVD-2026-53359","description":"OpenBK7231T's CHANNEL_SetLabel (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNEL_GetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/http_fns.c with no HTML encoding.","status":"published","published":"2026-08-05T12:26:21Z","modified":"2026-08-10T11:46:52Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:02:05.732685Z"}],"ghsa":[{"id":"GHSA-9c86-c5c2-55cr","title":"OpenBK7231T's CHANNEL_SetLabel() (src/cmnds/cmd_channels.c) stores channel labels received via...","description":"OpenBK7231T's CHANNEL_SetLabel() (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup() with no HTML sanitization. CHANNEL_GetLabel() returns these labels unsanitized, and they are rendered via hprintf255() at 15+ locations in src/httpserver/http_fns.c with no HTML encoding. An attacker with MQTT broker access (commonly unauthenticated in real deployments) can set a channel label containing a \u003cscript\u003e payload that executes when any user views the device's web panel.","status":"published","published":"2026-08-05T15:32:20Z","modified":"2026-08-05T15:32:23Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:10:07.328501Z"}],"nvd":[{"id":"CVE-2026-71274","description":"OpenBK7231T's CHANNEL_SetLabel (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNEL_GetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/http_fns.c with no HTML encoding.","status":"published","published":"2026-08-05T13:24:51.85Z","modified":"2026-10-24T15:10:00.19Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:35.031043Z"}]}}