Skip to main content

Bf 430 Firmware CVE-2021-31249

MEDIUM
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
2021-06-04 cve@mitre.org
Code Injection Bf 430 Firmware Bf 431 Firmware Bf 450M Firmware
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
Jun 04, 2021 - 21:15 nvd
MEDIUM 6.5

DescriptionNVD

A CRLF injection vulnerability was found on BF-430, BF-431, and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of validation on the parameter redirect= available on multiple CGI components.

AnalysisAI

A CRLF injection vulnerability was found on BF-430, BF-431, and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of validation on the parameter redirect= available on multiple. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-74. A CRLF injection vulnerability was found on BF-430, BF-431, and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of validation on the parameter redirect= available on multiple CGI components. Affected products include: Chiyu-Tech Bf-430 Firmware, Chiyu-Tech Bf-431 Firmware, Chiyu-Tech Bf-450M Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Bf 430 Firmware

View all
CVE-2021-31251 CRITICAL POC
9.8 Jun 04

An authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Tec
CVE-2021-31252 MEDIUM POC
6.1 Jun 04

An open redirect vulnerability exists in BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, and SEMAC devices f
CVE-2021-31641 MEDIUM POC
6.1 Jun 01

An unauthenticated XSS vulnerability exists in several IoT devices from CHIYU Technology, including BF-630, BF-450M, BF-
CVE-2020-8839 MEDIUM POC
6.1 Feb 12

Stored XSS was discovered on CHIYU BF-430 232/485 TCP/IP Converter devices before 1.16.00, as demonstrated by the /if.cg
CVE-2021-31250 MEDIUM POC
5.4 Jun 04

Multiple storage XSS vulnerabilities were discovered on BF-430, BF-431 and BF-450M TCP/IP Converter devices from CHIYU T

Same weakness CWE-74 – Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2016-4010 CRITICAL POC
9.8
CVE-2015-1592 HIGH POC
7.5
CVE-2025-20281 CRITICAL POC
10.0
CVE-2015-7309 MEDIUM POC
6.5
CVE-2014-8423 CRITICAL POC
10.0
CVE-2020-8468 HIGH POC
8.8
CVE-2015-3253 CRITICAL
9.8

Same technique Code Injection

View all
CVE-2012-0158 HIGH POC
8.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8
CVE-2018-1273 CRITICAL POC
9.8

Share

CVE-2021-31249 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy