VulnerabilityModified
CVE-2021-31641
An unauthenticated XSS vulnerability exists in several IoT devices from CHIYU Technology, including BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, BF-MINI-W, and SEMAC due to a lack of sanitization when the HTTP 404 message is generated.
MEDIUM 6.1EPSS 5.13%
Does this matter?
Lower severity and a low EPSS score (5.13%). Track it; it rarely justifies an emergency change on its own.
Description
An unauthenticated XSS vulnerability exists in several IoT devices from CHIYU Technology, including BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, BF-MINI-W, and SEMAC due to a lack of sanitization when the HTTP 404 message is generated.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 5.13% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- chiyu-tech/bf-430 firmware · chiyu-tech/bf-431 firmware · chiyu-tech/bf-450m firmware · chiyu-tech/semac s2 firmware · chiyu-tech/semac d1 firmware · chiyu-tech/semac d2 firmware · chiyu-tech/semac d4 firmware · chiyu-tech/semac s3v3 firmware · chiyu-tech/semac d2 n300 firmware · chiyu-tech/semac s1 osdp firmware · chiyu-tech/bf-630 firmware · chiyu-tech/bf-631w firmware · chiyu-tech/bf-830w firmware · chiyu-tech/webpass firmware · chiyu-tech/bfminiw firmware
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/162887/CHIYU-IoT-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
- https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31641Exploit, Third Party Advisory
- https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/#.YLY_lXmSlPYExploit, Third Party Advisory
- https://www.chiyu-tech.com/msg/message-Firmware-update-87.htmlVendor Advisory
- http://packetstormsecurity.com/files/162887/CHIYU-IoT-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
- https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31641Exploit, Third Party Advisory
- https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/#.YLY_lXmSlPYExploit, Third Party Advisory
- https://www.chiyu-tech.com/msg/message-Firmware-update-87.htmlVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.