CVE-2021-31251

EPSS 35.7%

Vexday Risk Score

35Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS —EPSS 35.7%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

03 Jun 2021Public PoC

04 Jun 2021Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

An authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Technology Inc allows obtaining a privileged connection with the target device by supplying a specially malformed request and an attacker may force the remote telnet server to believe that the user has already authenticated.

Affected products

n/a · n/a

public PoCs found — 1

exploitdbwww.exploit-db.com/exploits/49936unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31251 https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/#.YLqK1KhKguU https://www.chiyu-tech.com/msg/message-Firmware-update-87.html