CVE-2021-31641

Published: Jun 1, 2021Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

An unauthenticated XSS vulnerability exists in several IoT devices from CHIYU Technology, including BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, BF-MINI-W, and SEMAC due to a lack of sanitization when the HTTP 404 message is generated.

Affected (15)

Products: Chiyu Tech: Bf 430 Firmware, Bf 431 Firmware, Bf 450m Firmware, Semac S2 Firmware, Semac D1 Firmware, Semac D2 Firmware, Semac D4 Firmware, Semac S3v3 Firmware, Semac D2 N300 Firmware, Semac S1 Osdp Firmware, Bf 630 Firmware, Bf 631w Firmware, Bf 830w Firmware, Webpass Firmware, Bfminiw Firmware

15 products

Semac D2 N300 Firmware

Semac S1 Osdp Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Bf 430 Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Bf 430	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Bf 431 Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Bf 431	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Bf 450m Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Bf 450m	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Semac S2 Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Semac S2	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Semac D1 Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Semac D1	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Semac D2 Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Semac D2	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Semac D4 Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Semac D4	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Semac S3v3 Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Semac S3v3	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Semac D2 N300 Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Semac D2 N300	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Semac S1 Osdp Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Semac S1 Osdp	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Bf 630 Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Bf 630	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Bf 631w Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Bf 631w	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Bf 830w Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Bf 830w	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Webpass Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Webpass	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Chiyu Tech Bfminiw Firmware	All versions

Running on/with	Platform Versions
Chiyu Tech Bfminiw	All versions

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (8)

http://packetstormsecurity.com/files/162887/CHIYU-IoT-Cross-Site-Scripting.html

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31641

Source: cve@mitre.org

ExploitThird Party Advisory

https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/#.YLY_lXmSlPY

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.chiyu-tech.com/msg/message-Firmware-update-87.html

Source: cve@mitre.org

Vendor Advisory

http://packetstormsecurity.com/files/162887/CHIYU-IoT-Cross-Site-Scripting.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31641

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/#.YLY_lXmSlPY

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.chiyu-tech.com/msg/message-Firmware-update-87.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.