PT-2021-19219 · Chiyu Technology · Bf-630+7

Published 2021-06-04 · Updated 2021-06-08 · CVE-2021-31252

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions CHIYU Technology BF-630 CHIYU Technology BF-450M CHIYU Technology BF-430 CHIYU Technology BF-431 CHIYU Technology BF631-W CHIYU Technology BF830-W CHIYU Technology Webpass CHIYU Technology SEMAC

Description An open redirect issue exists in various devices from CHIYU Technology. This can be exploited by sending a specially crafted URL link to convince the user to click on it, potentially redirecting them to an unintended location.

Recommendations For CHIYU Technology BF-630, consider disabling any functionality that allows redirects until a patch is available. For CHIYU Technology BF-450M, restrict access to any modules that handle URL redirects to minimize the risk of exploitation. For CHIYU Technology BF-430, avoid using any features that involve clicking on links from untrusted sources until the issue is resolved. For CHIYU Technology BF-431, as a temporary workaround, consider implementing additional validation on URLs to prevent unintended redirects. For CHIYU Technology BF631-W, BF830-W, Webpass, and SEMAC, at the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2021-31252

Affected Products

Bf-430

Bf-431

Bf-450M

Bf-630

Bf631-W

Bf830-W

Semac

Webpass

References · 6

• 🔥 https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks · Exploit
• 🔥 https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31252 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-31252 · Security Note
• https://chiyu-tech.com/msg/message-Firmware-update-87.html · Vendor Advisory
• https://t.me/cvenotify/15879 · Telegram Post
• https://t.me/cvenotify/15612 · Telegram Post