CVE-2021-31252

Vulnerability

CHIYU BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, and SEMAC devices contain an open redirect vulnerability in their web interface. An attacker can craft a URL with a specially crafted redirect parameter that redirects users to an arbitrary external domain. The vulnerability affects unspecified firmware versions [1].

Exploitation

An attacker can exploit this by sending a link containing a malicious redirect URL to a user. No authentication is required; the user simply needs to click the link while accessing the device's web interface. The lack of validation on the redirect parameter allows the attacker to specify any destination [1].

Impact

Successful exploitation allows an attacker to redirect users to attacker-controlled websites, enabling phishing attacks, malware distribution, or credential theft. Because the redirect originates from a trusted device, users may be more likely to trust the destination [1].

Mitigation

As of the publication date (June 4, 2021), no official fix has been released by CHIYU. Users are advised to monitor CHIYU's firmware update page [2] for patches and to avoid clicking suspicious links that point to these devices. If the devices are no longer supported, replacement with updated models may be necessary [1][2].