OpenBK7231T_App's CHANNEL_SetLabel() function uses strdup() to store channel labels received from the MQTT SetChannelLabel command without performing any HTML sanitization. The CHANNEL_GetLabel() function returns these labels unsanitized, and they are rendered in multiple locations in the HTTP server code (src/httpserver/http_fns.c) using hprintf255() without HTML encoding. Because MQTT brokers in typical deployments are often unauthenticated, an attacker with MQTT broker access can set channel labels containing <script> payloads. These payloads execute in the context of the device's web panel when viewed by users, resulting in a stored cross-site scripting vulnerability (CWE-79).

Successful exploitation allows an attacker with MQTT broker access to execute arbitrary JavaScript code in the context of the device's web interface for any user viewing the channel labels. This can lead to compromise of user sessions, theft of sensitive information, or other high-impact consequences. The CVSS 3.1 base score is 8.5, reflecting high impact on confidentiality and integrity with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or secure MQTT broker access to trusted users only to prevent unauthorized label injection. Avoid exposing the MQTT broker to untrusted networks. Monitor for updates from the vendor for an official fix or mitigation.