OpenBK7231T_App's CHANNEL_SetLabel function stores channel labels received through the MQTT SetChannelLabel command using strdup without performing any HTML sanitization. These labels are then returned unsanitized by CHANNEL_GetLabel and rendered via hprintf255 in over 15 locations within the HTTP server code (src/httpserver/http_fns.c) without HTML encoding. This results in a CWE-79 Cross-Site Scripting vulnerability that can allow an attacker to inject malicious scripts into the web interface, potentially compromising confidentiality and integrity of the affected system.

The vulnerability allows an attacker with network access to send specially crafted MQTT SetChannelLabel commands that inject malicious HTML or JavaScript code. Because the labels are rendered unsanitized in multiple HTTP server locations, this can lead to Cross-Site Scripting attacks, compromising confidentiality and integrity of the web interface. There is no impact on availability. The CVSS 3.1 score of 8.5 reflects high severity with attack vector as adjacent network, low attack complexity, no privileges required, user interaction required, and scope changed.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider restricting access to the MQTT SetChannelLabel command to trusted sources only and monitor for suspicious activity. Avoid exposing the affected HTTP server interface to untrusted networks.