.. / CVE-2021-31250

Exploit for CHIYU TCP/IP Converter - Cross-Site Scripting (CVE-2021-31250)

Description:

CHIYU BF-430, BF-431 and BF-450M TCP/IP Converter devices contain a cross-site scripting vulnerability due to a lack of sanitization of the input on the components man.cgi, if.cgi, dhcpc.cgi, and ppp.cgi.

Nuclei Template

View the template here CVE-2021-31250.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-31250.yaml
Copy

References:

https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/
https://github.com/ARPSyndicate/cvemon
https://www.chiyu-tech.com/msg/message-Firmware-update-87.htm
https://nvd.nist.gov/vuln/detail/CVE-2021-31250
https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31250