peter bassill · operator
$ cve CVE-2021-31642 JSON

CVE-2021-31642 EXPLOIT

6.5
MEDIUM · CVSS 3.1 · EPSS 43.7% (pctl 99)

Patch early

A public exploit exists.

Description

A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC. The vulnerability can be explored by sending an unexpected integer (> 32 bits) on the page parameter that will crash the web portal and making it unavailable until a reboot of the device.

Scoring

CVSS6.5 (MEDIUM, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS43.67% — more likely to be exploited than 99% of all CVEs
WeaknessCWE-190
On CISA KEVno
Public exploityes
Published2021-06-01
Last modified2026-06-17

Affected (22)

VendorProduct
chiyu-techbf-630
chiyu-techbf-630 firmware
chiyu-techbf-631
chiyu-techbf-631 firmware
chiyu-techbiosense
chiyu-techbiosense firmware
chiyu-techsemac d1
chiyu-techsemac d1 firmware
chiyu-techsemac d2
chiyu-techsemac d2 firmware
chiyu-techsemac d2 n300
chiyu-techsemac d2 n300 firmware
chiyu-techsemac d4
chiyu-techsemac d4 firmware
chiyu-techsemac s1 osdp
chiyu-techsemac s1 osdp firmware
chiyu-techsemac s2
chiyu-techsemac s2 firmware
chiyu-techsemac s3v3
chiyu-techsemac s3v3 firmware
chiyu-techwebpass
chiyu-techwebpass firmware

Public exploits

SourceTitleDate
exploit-dbCHIYU IoT Devices - Denial of Service (DoS)2021-06-03

References

→ the Explorer  ·  watch your stack  ·  NVD