Technical impact
OpenBK7231T's CHANNEL_SetLabel function (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command with strdup, omitting any HTML sanitization. When the label is retrieved with CHANNEL_GetLabel, the raw data is returned and rendered in the web interface using hprintf255 at over fifteen locations within src/httpserver/http_fns.c, without HTML encoding. This results in a stored cross‑site scripting vulnerability, allowing an attacker to embed malicious JavaScript that will execute in any browser that views the device’s web panel, potentially enabling session hijack, credential theft, or other client‑side compromise.
Affected Systems
The vulnerability affects the OpenBK7231T_App firmware released by openshwprojects. No specific version range is listed in the advisory, so all current and future builds that use the vulnerable CHANNEL_SetLabel implementation are at risk.
Risk and Exploitability
The CVSS score of 8.5 indicates high severity. The EPSS score of 0.0018 (approximately <1%) shows a very low but nonzero likelihood that this vulnerability is actively exploited. The description suggests the common deployment of MQTT brokers without authentication or with weak access controls, so it is inferred that an attacker could reach the vulnerable command. Because the flaw is triggered by MQTT traffic, it is inferred that the attack can be performed from any network location that can reach the broker, making it broadly exploitable in the absence of access restrictions.
