OpenBK7231T's CHANNEL_SetLabel() (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup() with no HTML sani…

CVE-2026-71274 describes a stored Cross-Site Scripting (XSS) vulnerability in the OpenBK7231T open-source IoT firmware. The vulnerability exists in CHANNEL_SetLabel() within src/cmnds/cmd_channels.c, which stores channel labels received via the MQTT SetChannelLabel command using strdup() without any HTML sanitization. The unsanitized labels are returned by CHANNEL_GetLabel() and rendered via hprintf255() in over 15 locations across src/httpserver/http_fns.c without HTML encoding. An attacker with access to the MQTT broker — commonly unauthenticated in real-world IoT deployments — can inject a malicious script payload as a channel label. This payload executes in the browser of any user who views the device's web panel, enabling session hijacking, credential theft, or further device compromise. The attack surface is significant given the widespread use of unauthenticated MQTT brokers in consumer and industrial IoT environments.