← Back

CVE-2021-31643

nvd nist
Published: Jun 1, 2021Modified: Jun 17, 2026

JSON object

Loading...
5.4
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.3 / Impact: 2.7
Source: NVD

Description

An XSS vulnerability exists in several IoT devices from CHIYU Technology, including SEMAC, Biosense, BF-630, BF-631, and Webpass due to a lack of sanitization on the component if.cgi - username parameter.

Affected (11)

Chiyu Tech
11 products
Bf 631 Firmware
Bf 630 Firmware
Semac S2 Firmware
Semac D1 Firmware
Semac D2 Firmware
Semac D4 Firmware
Semac S3v3 Firmware
Semac D2 N300 Firmware
Semac S1 Osdp Firmware
Webpass Firmware
Biosense Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Bf 631 Firmware
All versions
Running on/withPlatform Versions
Chiyu Tech
Bf 631
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Bf 630 Firmware
All versions
Running on/withPlatform Versions
Chiyu Tech
Bf 630
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Semac S2 Firmware
All versions
Running on/withPlatform Versions
Chiyu Tech
Semac S2
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Semac D1 Firmware
All versions
Running on/withPlatform Versions
Chiyu Tech
Semac D1
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Semac D2 Firmware
All versions
Running on/withPlatform Versions
Chiyu Tech
Semac D2
All versions
Configuration F
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Semac D4 Firmware
All versions
Running on/withPlatform Versions
Chiyu Tech
Semac D4
All versions
Configuration G
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Semac S3v3 Firmware
All versions
Running on/withPlatform Versions
Chiyu Tech
Semac S3v3
All versions
Configuration H
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Semac D2 N300 Firmware
All versions
Running on/withPlatform Versions
Chiyu Tech
Semac D2 N300
All versions
Configuration I
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Semac S1 Osdp Firmware
All versions
Running on/withPlatform Versions
Chiyu Tech
Semac S1 Osdp
All versions
Configuration J
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Webpass Firmware
All versions
Running on/withPlatform Versions
Chiyu Tech
Webpass
All versions
Configuration K
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Biosense Firmware
All versions
Running on/withPlatform Versions
Chiyu Tech
Biosense
All versions

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (8)

Source: cve@mitre.org
ExploitThird Party AdvisoryVDB Entry
Source: cve@mitre.org
ExploitThird Party Advisory
Source: cve@mitre.org
ExploitThird Party Advisory
Source: cve@mitre.org
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.