CVE-2021-31250

MEDIUMNuclei

chiyu-tech bf-430_firmware Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2021-31250 has a selected CVSS score of 5.4 (medium); EIP currently links 1 Nuclei template.

Description

Multiple storage XSS vulnerabilities were discovered on BF-430, BF-431 and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of sanitization of the input on the components man.cgi, if.cgi, dhcpc.cgi, ppp.cgi.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Apr 8, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

bf-430_firmware

Browse chiyu-tech / bf-430_firmware
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMCHIYU TCP/IP Converter - Cross-Site ScriptingCVSS 5.4

CHIYU BF-430, BF-431 and BF-450M TCP/IP Converter devices contain a cross-site scripting vulnerability due to a lack of sanitization of the input on the components man.cgi, if.cgi, dhcpc.cgi, and ppp.cgi.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.

Remediation

To mitigate this vulnerability, ensure that all user-supplied input is properly validated and sanitized before being rendered in web pages.

WeaknessesCWE-79
Authorsgeeknik
Template tagscve2021cvechiyuxssiotintrusivechiyu-techvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:o:chiyu-tech:bf-430_firmware:-:*:*:*:*:*:*:*
https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31250 https://www.chiyu-tech.com/msg/message-Firmware-update-87.htm https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/ https://nvd.nist.gov/vuln/detail/CVE-2021-31250 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

4