What is the CVSS score of CVE-2026-71274?

CVE-2026-71274 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of OpenBK7231T are affected by CVE-2026-71274?

OpenBK7231T firmware contains a stored cross-site scripting vulnerability in the web management panel that allows adjacent-network attackers to inject persistent malicious JavaScript through MQTT…

How to fix or mitigate CVE-2026-71274?

Within 24 hours: audit all OpenBK7231T device deployments and MQTT broker network connectivity, immediately restrict MQTT broker access to trusted networks through firewall segmentation, and disable MQTT entirely if operationally unnecessary. Within 7 days: require MQTT broker authentication with complex credentials if MQTT must remain enabled, deploy network monitoring to detect suspicious MQTT SetChannelLabel commands, and review device web panel access logs for unauthorized activity. Within 30 days: contact OpenBK/vendor for patch availability and timeline, evaluate firmware alternatives or device replacement for critical infrastructure, and implement formal access control policies restricting IoT management panel exposure to trusted administrative networks only.

OpenBK7231T CVE-2026-71274

EUVD-2026-53359 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-05 TuranSec

GHSA-9c86-c5c2-55cr

XSS Openbk7231T App

8.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.5 HIGH

AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.5 HIGH

AV:A because MQTT broker access is adjacent-network; PR:N because MQTT is unauthenticated in typical deployments per the description; S:C and C:H/I:H because XSS crosses device boundary into the browser, enabling session theft and panel manipulation; A:N because no availability impact is described.

3.1 AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 13:40 vuln.today

CVE Published

Aug 05, 2026 - 12:26 cve.org

HIGH 8.5

DescriptionCVE.org

OpenBK7231T's CHANNEL_SetLabel() (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup() with no HTML sanitization. CHANNEL_GetLabel() returns these labels unsanitized, and they are rendered via hprintf255() at 15+ locations in src/httpserver/http_fns.c with no HTML encoding. An attacker with MQTT broker access (commonly unauthenticated in real deployments) can set a channel label containing a <script> payload that executes when any user views the device's web panel.

AnalysisAI

Stored XSS in OpenBK7231T firmware allows an adjacent-network attacker with MQTT broker access - commonly unauthenticated in real IoT deployments - to inject persistent JavaScript payloads into device channel labels via the SetChannelLabel MQTT command. The malicious label survives device reboots in memory and executes in the browser of every user who subsequently views the device's built-in web management panel, with high confidentiality and integrity impact in a changed scope. No public exploit has been identified at time of analysis, but the unauthenticated MQTT broker pattern common in home automation environments effectively lowers the practical exploitation barrier below what the AV:A vector alone implies.

Technical ContextAI

OpenBK7231T is an open-source alternative firmware for Beken BK7231T microcontrollers used in consumer smart-home devices such as smart plugs, bulbs, and switches, maintained under the OpenShwProjects organization (CPE: cpe:2.3:a:openshwprojects:openbk7231t_app:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS). The attack path begins in src/cmnds/cmd_channels.c, where CHANNEL_SetLabel() receives channel label strings delivered via the MQTT SetChannelLabel command and stores them with strdup(), applying no HTML sanitization at ingestion time. CHANNEL_GetLabel() later returns these stored strings without any encoding step, and hprintf255() - the firmware's HTTP response formatting function in src/httpserver/http_fns.c - renders them verbatim at 15 or more distinct locations in the web panel. MQTT, the lightweight publish-subscribe messaging protocol central to this vulnerability, is routinely deployed without broker-level authentication in home automation environments, making PR:N a realistic baseline assumption rather than a worst-case one.

RemediationAI

No patched release version has been independently confirmed from the available reference data; the sole reference points to the upstream GitHub repository at https://github.com/openshwprojects/OpenBK7231T_App, which should be monitored for a commit or tagged release introducing HTML sanitization in CHANNEL_SetLabel() and output encoding in the hprintf255() render paths across src/httpserver/http_fns.c. The highest-impact interim mitigation is enabling authentication on the MQTT broker (e.g., username/password or TLS mutual authentication in Mosquitto via the password_file and cafile directives), which directly eliminates the PR:N attack surface at the cost of requiring credential management for all MQTT clients. Additionally, restrict the device's web panel to trusted LAN hosts via firewall or router ACLs, preventing an attacker from leveraging a successfully injected payload even if the MQTT layer is compromised. If the web panel is not operationally required, disabling it entirely removes the UI:R attack surface completely, with the trade-off of losing local web-based device management. Internet-exposure of the MQTT broker must be avoided in any deployment of this firmware.