CVE-2021-31250: CHIYU TCP/IP Converter Web CGI Stored XSS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

medium priorityThe CVSS base score is 5.4 (Medium) and exploitation requires authenticated access plus user interaction, though the very high EPSS and public exploit references raise concern for exposed devices.

What it is

CHIYU BF-430, BF-431 and BF-450M TCP/IP converter devices fail to sanitize input in the man.cgi, if.cgi, dhcpc.cgi and ppp.cgi components, allowing stored cross-site scripting. Because the injected payload persists in device configuration pages, any user who later views those pages can be attacked, which matters for internet-exposed IoT converters commonly managed through a browser.

Impact

An attacker can execute arbitrary script in the browser context of a victim who views the affected configuration pages, potentially stealing session data or performing actions as that user. The CVSS scope change indicates the impact can extend beyond the vulnerable component to the user's browser session.

Attack surface

The flaw is reachable over the network through the device web interface (AV:N), requires the attacker to have some authenticated access to inject the payload (PR:L), and requires a victim to view the crafted page (UI:R). No further detail on the exact injection point is provided beyond the four CGI components.

Exploitation

Public exploit references are tagged Exploit by third parties, and EPSS is very high (0.796, 99.6th percentile), but the CVE is not listed in CISA KEV, so active exploitation in the wild is not confirmed by the record.

What to do

• Apply the vendor firmware update referenced in the CHIYU advisory for BF-430, BF-431 and BF-450M devices.
• If patching is not immediately possible, remove affected devices from direct internet exposure and restrict management access to trusted networks.
• Enforce strong unique credentials on the device web interface and avoid shared or default accounts.
• Disable or block access to the affected CGI endpoints (man.cgi, if.cgi, dhcpc.cgi, ppp.cgi) where operationally feasible.
• Monitor vendor channels for further firmware guidance since the record does not list fixed versions.

Detection

• Inspect HTTP requests to man.cgi, if.cgi, dhcpc.cgi and ppp.cgi for script tags or unusual encoded payloads in parameters.
• Review device configuration pages and stored settings for injected HTML or JavaScript content.
• Alert on unexpected outbound connections or script-driven requests originating from management browsers accessing these devices.
• Track authentication and access logs for the device web interface for anomalous or repeated POST activity to the affected CGI paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.