CVE-2021-31641

Vulnerability

An unauthenticated cross-site scripting (XSS) vulnerability exists in several CHIYU Technology IoT devices, including BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, BF-MINI-W, and SEMAC. The vulnerability arises because the HTTP 404 error page does not sanitize user-supplied input, allowing an attacker to inject arbitrary JavaScript or HTML. The affected firmware versions are those prior to the vendor's security update [1].

Exploitation

An attacker can exploit this vulnerability remotely without authentication. By sending a crafted HTTP request that triggers a 404 error with a malicious payload (e.g., a script tag) in the URL, the payload is reflected in the resulting error page and executed in the browser of any user viewing that page. No special network position or user interaction beyond viewing the page is required [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the device's web interface. This can lead to session hijacking, defacement, redirection to malicious sites, or extraction of sensitive information. Since the vulnerability is unauthenticated, any user who accesses the device's web interface can be affected [1].

Mitigation

CHIYU Technology has released firmware updates to address this vulnerability. Users should update their devices to the latest firmware version available from the vendor's support page. No known workarounds exist; applying the patch is the recommended mitigation [1].