CVE-2026-71274

Summary

The flaw allows an attacker to inject malicious HTML content via the MQTT SetChannelLabel command, which can lead to Cross-Site Scripting (XSS) attacks.

Exploitability

Exploitation is relatively easy given the lack of input validation and sanitization. An attacker needs to send a crafted MQTT message to the affected device.

Blast radius

If exploited, the XSS attack could lead to unauthorized access to user sessions, data theft, or other malicious activities on the affected device and potentially on connected web interfaces.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the affected feature or restrict access to the MQTT SetChannelLabel command to prevent unauthorized input.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.