CVE-2021-31641

An unauthenticated XSS vulnerability exists in several IoT devices from CHIYU Technology, including BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, BF-MINI-W, and SEMAC due to a lack of sanitization when the HTTP 404 message is generated.

• CWE-79

• http://packetstormsecurity.com/files/162887/CHIYU-IoT-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31641Exploit, Third Party Advisory
• https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/#.YLY_lXmSlPYExploit, Third Party Advisory
• https://www.chiyu-tech.com/msg/message-Firmware-update-87.htmlVendor Advisory
• http://packetstormsecurity.com/files/162887/CHIYU-IoT-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31641Exploit, Third Party Advisory
• https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/#.YLY_lXmSlPYExploit, Third Party Advisory
• https://www.chiyu-tech.com/msg/message-Firmware-update-87.htmlVendor Advisory

Published

Jun 1, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-31630Command Injection in Open PLC Webserver v3 allows remote att…8.8
• CVE-2021-31631b2evolution CMS v7.2.3 was discovered to contain a Cross-Sit…8.8
• CVE-2021-31632b2evolution CMS v7.2.3 was discovered to contain a SQL injec…9.8
• CVE-2021-31635Server-Side Template Injection (SSTI) vulnerability in jFina…9.8
• CVE-2021-31637An issue found in UwAmp v.1.1, 1.2, 1.3, 2.0, 2.1, 2.2, 2.2.…7.8
• CVE-2021-3164ChurchRota 2.6.4 is vulnerable to authenticated remote code …8.8
• CVE-2021-31642A denial of service condition exists after an integer overfl…6.5
• CVE-2021-31643An XSS vulnerability exists in several IoT devices from CHIY…5.4
• CVE-2021-31645An issue was discovered in glFTPd 2.11a that allows remote a…7.5
• CVE-2021-31646Gestsup before 3.2.10 allows account takeover through the pa…9.8
• CVE-2021-31649In applications using jfinal 4.9.08 and below, there is a de…9.8
• CVE-2021-3165SmartAgent 3.1.0 allows a ViewOnly attacker to create a Supe…8.8