CVE-2021-31252

Published: Jun 4, 2021Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

An open redirect vulnerability exists in BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, and SEMAC devices from CHIYU Technology that can be exploited by sending a link that has a specially crafted URL to convince the user to click on it.

Affected (14)

Products: Chiyu Tech: Bf 430 Firmware, Bf 431 Firmware, Bf 450m Firmware, Semac S2 Firmware, Semac D1 Firmware, Semac D2 Firmware, Semac D4 Firmware, Semac S3v3 Firmware, Semac D2 N300 Firmware, Semac S1 Osdp Firmware, Bf 630 Firmware, Bf 631w Firmware, Bf 830w Firmware, Webpass Firmware

14 products

Semac D2 N300 Firmware

Semac S1 Osdp Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Bf 430 Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Bf 430	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Bf 431 Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Bf 431	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Bf 450m Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Bf 450m	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Semac S2 Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Semac S2	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Semac D1 Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Semac D1	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Semac D2 Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Semac D2	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Semac D4 Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Semac D4	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Semac S3v3 Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Semac S3v3	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Semac D2 N300 Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Semac D2 N300	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Semac S1 Osdp Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Semac S1 Osdp	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Bf 630 Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Bf 630	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Bf 631w Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Bf 631w	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Bf 830w Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Bf 830w	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Webpass Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Webpass	All versions

Related CWEs

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

References (6)

https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31252

Source: cve@mitre.org

ExploitThird Party Advisory

https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.chiyu-tech.com/msg/message-Firmware-update-87.html

Source: cve@mitre.org

Vendor Advisory

https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31252

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.chiyu-tech.com/msg/message-Firmware-update-87.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.