CVE-2026-71274 openshwprojects CVE debrief

Who should care

Users and administrators of OpenBK7231T devices, as well as developers and security teams responsible for maintaining and securing these devices, should review the device's code and consider applying patches or updates to fix the CHANNEL_SetLabel() and CHANNEL_GetLabel() functions. They should also implement HTML sanitization for channel labels, restrict access to the MQTT broker to prevent unauthorized modifications, and monitor device logs for suspicious activity. Additionally, they should consider replacing or updating affected devices if necessary. The vulnerability has a high CVSS score of 8.5, indicating a high severity, and an attacker with MQTT broker access can set a channel label containing a <script> payload that executes when any user views the device's web panel. Therefore, it is essential to take immediate action to mitigate this vulnerability. Security teams should prioritize this vulnerability and assign an owner for follow-up. They should also review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review. Furthermore, they should track exceptions, retest remediated assets, and close the item only after evidence is documented. It is crucial to validate affected scope, severity, and vendor guidance through a thorough review of the supplied official advisory or CVE record. A thorough review of the device's code and configurations is necessary to identify potential vulnerabilities and ensure the secure operation of the device. This may involve reviewing the device's documentation, analyzing network traffic, and conducting vulnerability assessments. By taking these steps, users and administrators can help prevent similar vulnerabilities from occurring in the future and ensure the security and integrity of their devices and data. The OpenBK7231T device is widely used in various industries, and its vulnerability can have significant consequences if not addressed promptly. Therefore, it is essential to prioritize this vulnerability and take immediate action to mitigate its impact. The CVE record was published on 2026-08-05T13:24:

Technical summary

The CHANNEL_SetLabel() function in OpenBK7231T stores channel labels received via the MQTT SetChannelLabel command using strdup() with no HTML sanitization. The CHANNEL_GetLabel() function returns these labels unsanitized, and they are rendered via hprintf255() at 15+ locations in src/httpserver/http_fns.c with no HTML encoding. This allows an attacker with MQTT broker access to set a channel label containing a <script> payload that executes when any user views the device's web panel.

Defensive priority

High priority due to the high CVSS score of 8.5 and the potential for unauthenticated attacks.

Recommended defensive actions

• Apply patches or updates to OpenBK7231T to fix the CHANNEL_SetLabel() and CHANNEL_GetLabel() functions.
• Implement HTML sanitization for channel labels.
• Restrict access to the MQTT broker to prevent unauthorized modifications.
• Monitor device logs for suspicious activity.
• Consider replacing or updating affected devices.

Evidence notes

The CVE description provides evidence of the vulnerability, including the lack of HTML sanitization in CHANNEL_SetLabel() and the unsanitized rendering of channel labels in multiple locations. OpenBK7231T's CHANNEL_SetLabel() stores channel labels received via the MQTT SetChannelLabel command using strdup() with no HTML sanitization. CHANNEL_GetLabel() returns these labels unsanitized, and they are rendered via hprintf255() at 15+ locations in src/httpserver/http_fns.c with no HTML encoding. An attacker with MQTT broker access (commonly unauthenticated in real deployments) can set a channel label containing a <script> payload that executes when any user views the device's web panel. The vulnerability has a high CVSS score of 8.5, indicating a high severity. Users and administrators of OpenBK7231T devices, as well as developers and security teams, should review the device's code and consider applying patches or updates to fix the CHANNEL_SetLabel() and CHANNEL_GetLabel() functions.

Official resources