Lucene search

MitreCVE-2021-31249

HistoryJun 04, 2021 - 9:15 p.m.

CVE-2021-31249

2021-06-0421:15:07

CWE-74

mitre

web.nvd.nist.gov

103

crlf injection

vulnerability

chiyu technology inc

bf-430

bf-431

bf-450m

tcp/ip converter

nvd

cve-2021-31249

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.007

Percentile

79.8%

JSON

A CRLF injection vulnerability was found on BF-430, BF-431, and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of validation on the parameter redirect= available on multiple CGI components.

Affected configurations

Nvd

Node

chiyu-techbf-430Match-

AND

chiyu-techbf-430_firmwareMatch-

Node

chiyu-techbf-431Match-

AND

chiyu-techbf-431_firmwareMatch-

Node

chiyu-techbf-450mMatch-

AND

chiyu-techbf-450m_firmwareMatch-

VendorProductVersionCPE
chiyu-techbf-430-cpe:2.3:h:chiyu-tech:bf-430:-:*:*:*:*:*:*:*
chiyu-techbf-430_firmware-cpe:2.3:o:chiyu-tech:bf-430_firmware:-:*:*:*:*:*:*:*
chiyu-techbf-431-cpe:2.3:h:chiyu-tech:bf-431:-:*:*:*:*:*:*:*
chiyu-techbf-431_firmware-cpe:2.3:o:chiyu-tech:bf-431_firmware:-:*:*:*:*:*:*:*
chiyu-techbf-450m-cpe:2.3:h:chiyu-tech:bf-450m:-:*:*:*:*:*:*:*
chiyu-techbf-450m_firmware-cpe:2.3:o:chiyu-tech:bf-450m_firmware:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
chiyu-tech	bf-430	-	cpe:2.3:h:chiyu-tech:bf-430:-:::::::*
chiyu-tech	bf-430_firmware	-	cpe:2.3:o:chiyu-tech:bf-430_firmware:-:::::::*
chiyu-tech	bf-431	-	cpe:2.3:h:chiyu-tech:bf-431:-:::::::*
chiyu-tech	bf-431_firmware	-	cpe:2.3:o:chiyu-tech:bf-431_firmware:-:::::::*
chiyu-tech	bf-450m	-	cpe:2.3:h:chiyu-tech:bf-450m:-:::::::*
chiyu-tech	bf-450m_firmware	-	cpe:2.3:o:chiyu-tech:bf-450m_firmware:-:::::::*

References

gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31249

seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/

www.chiyu-tech.com/msg/message-Firmware-update-87.html

Social References

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.007

Percentile

79.8%

JSON

Related for CVE-2021-31249