PT-2021-19217 · Chiyu Technology · Bf-431+2

Published 2021-06-04 · Updated 2021-06-08 · CVE-2021-31250

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions CHIYU Technology Inc BF-430 CHIYU Technology Inc BF-431 CHIYU Technology Inc BF-450M

Description The issue is related to multiple storage XSS vulnerabilities discovered in certain devices from CHIYU Technology Inc. These vulnerabilities are caused by a lack of sanitization of the input on several components, including man.cgi, if.cgi, dhcpc.cgi, and ppp.cgi.

Recommendations For CHIYU Technology Inc BF-430, consider disabling access to the vulnerable components man.cgi, if.cgi, dhcpc.cgi, and ppp.cgi until a fix is available. For CHIYU Technology Inc BF-431, consider disabling access to the vulnerable components man.cgi, if.cgi, dhcpc.cgi, and ppp.cgi until a fix is available. For CHIYU Technology Inc BF-450M, consider disabling access to the vulnerable components man.cgi, if.cgi, dhcpc.cgi, and ppp.cgi until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-31250

Affected Products

Bf-430

Bf-431

Bf-450M

References · 5

• 🔥 https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks · Exploit
• 🔥 https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31250 · Exploit
• https://chiyu-tech.com/msg/message-Firmware-update-87.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31250 · Security Note
• https://t.me/cvenotify/15614 · Telegram Post