CVE-2026-71274 Overview
CVE-2026-71274 is a stored cross-site scripting (XSS) vulnerability in OpenBK7231T, an open source firmware for BK7231 series smart home devices. The flaw resides in CHANNEL_SetLabel() located in src/cmnds/cmd_channels.c. The function stores channel labels received through the MQTT SetChannelLabel command using strdup() without any HTML sanitization. CHANNEL_GetLabel() returns these labels unsanitized, and hprintf255() renders them at more than 15 locations inside src/httpserver/http_fns.c without HTML encoding. An attacker with MQTT broker access can inject a <script> payload that executes when a user views the device's web panel [CWE-79].
Critical Impact
Attackers on the adjacent network can hijack administrator sessions and manipulate device configuration through the OpenBK7231T web interface.
Affected Products
- OpenBK7231T firmware (OpenBK7231T_App)
- Devices flashed with OpenBK7231T that expose MQTT and HTTP management
- Deployments using unauthenticated or shared MQTT brokers
Discovery Timeline
- 2026-08-05 - CVE-2026-71274 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-71274
Vulnerability Analysis
OpenBK7231T exposes a channel label feature that operators use to name device channels for identification in the web UI. The SetChannelLabel MQTT command writes attacker-controlled strings directly into memory via strdup(). No allowlist, escape routine, or entity encoding runs on the input path. On the output path, CHANNEL_GetLabel() hands the raw string to hprintf255(), which emits it into HTML responses served by the built-in web server.
Because labels appear on multiple pages of the administrative panel, a single injected payload triggers on many user workflows. A stored <script> tag runs with the origin of the device's web interface, giving the attacker full control over the DOM and any authenticated session.
Root Cause
The root cause is missing output encoding [CWE-79]. Both the MQTT ingest path and the HTTP rendering path treat channel labels as safe text. Neither CHANNEL_SetLabel() nor the rendering helpers in src/httpserver/http_fns.c apply HTML entity encoding before emitting label data into markup.
Attack Vector
An attacker requires access to the MQTT broker the device subscribes to. In many real deployments the broker is unauthenticated or shared across a local network. The attacker publishes a SetChannelLabel message containing a JavaScript payload as the label value. The payload persists in device memory and executes whenever an administrator or user loads a page that renders the label. Exploitation succeeds without direct HTTP access to the device.
See the OpenBK7231T App Repository for the affected source files.
Detection Methods for CVE-2026-71274
Indicators of Compromise
- MQTT publish messages to SetChannelLabel topics containing HTML tag characters such as <, >, or script.
- Device web pages returning channel label fields with unescaped <script>, onerror=, or javascript: substrings.
- Unexpected outbound HTTP requests originating from browsers immediately after viewing the OpenBK7231T admin panel.
Detection Strategies
- Inspect MQTT broker logs for SetChannelLabel commands whose payload contains angle brackets or JavaScript event handler keywords.
- Perform periodic HTTP scraping of device panels and flag responses whose channel label DOM nodes contain executable markup.
- Compare stored channel labels against an allowlist of printable ASCII characters and alert on deviations.
Monitoring Recommendations
- Enable authentication and access control lists on the MQTT broker and log all publish activity for OpenBK7231T topics.
- Capture browser telemetry from workstations used to administer IoT devices to identify script execution from device origins.
- Baseline channel label values after provisioning and alert on out-of-band changes.
How to Mitigate CVE-2026-71274
Immediate Actions Required
- Restrict MQTT broker access to authenticated clients only and remove anonymous publish permissions on OpenBK7231T topics.
- Segment OpenBK7231T devices onto a management VLAN that is unreachable from general user networks.
- Clear any existing channel labels and reset them to known-safe values using the device console.
Patch Information
No vendor patch is referenced in the NVD entry at the time of publication. Monitor the OpenBK7231T App Repository for commits that add HTML entity encoding to CHANNEL_GetLabel() output paths in src/httpserver/http_fns.c and input validation to CHANNEL_SetLabel() in src/cmnds/cmd_channels.c.
Workarounds
- Enforce MQTT username, password, and TLS client certificate authentication on the broker.
- Block MQTT payloads containing <, >, or & characters at a proxying broker or gateway.
- Access the device web panel only from a dedicated administrative browser profile with JavaScript disabled where feasible.
# Configuration example: restrict MQTT ACL for OpenBK7231T topics
# /etc/mosquitto/acl.conf
user iot_admin
topic readwrite openbk/+/SetChannelLabel
user iot_readonly
topic read openbk/+/#
# Reject anonymous connections in mosquitto.conf
allow_anonymous false
password_file /etc/mosquitto/passwd
acl_file /etc/mosquitto/acl.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
