← Vulnerability feed

Vulnerability record · CVE-2021-31642 · published 1 June 2021

CVE-2021-31642: Chiyu-tech semac s2 firmware integer overflow vulnerability

CChiyu Tech · Semac S2 Firmware

A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC. The vulnerability can be explored by sending an unexpected integer (> 32 bits) on the page parameter that will crash the web portal and making it unavailable until a reboot of the device.

6.5 CVSS 3.1 Medium EPSS 44% · top 1.3% CWE-190 · Integer overflow
6.5CVSS 3.1 base score, v2 6.8
44%EPSS exploitation probability, 30 days
NoNot in CISA KEV
11Affected product versions listed by NVD
8References, 6 tagged exploit
17 Jun 2026Last modified by NVD

Description

A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC. The vulnerability can be explored by sending an unexpected integer (> 32 bits) on the page parameter that will crash the web portal and making it unavailable until a reboot of the device.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

11 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/162934/CHIYU-IoT-Denial-Of-Service.html ExploitThird Party AdvisoryVDB Entry
https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31642 ExploitThird Party Advisory
https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/ ExploitThird Party Advisory
https://www.chiyu-tech.com/msg/message-Firmware-update-87.html Vendor Advisory
http://packetstormsecurity.com/files/162934/CHIYU-IoT-Denial-Of-Service.html ExploitThird Party AdvisoryVDB Entry
https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31642 ExploitThird Party Advisory
https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/ ExploitThird Party Advisory
https://www.chiyu-tech.com/msg/message-Firmware-update-87.html Vendor Advisory

Track CVE-2021-31642 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-31251Chiyu-tech bf-430 firmware improper authentication vulnerabilityAn authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Technology Inc allows obtaining …EPSS 36%6.1CVE-2021-31252Chiyu-tech bf-430 firmware open redirect vulnerabilityAn open redirect vulnerability exists in BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, and SEMAC devices from CHIYU Technology that can…EPSS 29%6.1CVE-2021-31641Chiyu-tech bf-430 firmware cross-site scripting vulnerabilityAn unauthenticated XSS vulnerability exists in several IoT devices from CHIYU Technology, including BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W…EPSS 5.1%5.4CVE-2021-31643CHIYU IoT devices stored XSS in if.cgi username parameterSeveral CHIYU Technology IoT devices (SEMAC, Biosense, BF-630, BF-631, Webpass) fail to sanitize the username parameter in if.cgi, allowing cross-sit…EPSS 88%analysed8.4CVE-2025-48595Android Framework integer overflow enables local code executionAn integer overflow in multiple locations of the Android Framework can be turned into code execution. It allows a local attacker to escalate privileg…KEVEPSS 1.7%analysed7.8CVE-2021-30952Apple WebKit integer overflow allows code execution via crafted web contentAn integer overflow in Apple's WebKit engine was fixed by improved input validation across tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS/iPadOS 15…KEVEPSS 7.0%analysed7.8CVE-2026-21385Qualcomm chipset firmware memory corruption via alignment integer overflowA memory corruption flaw in Qualcomm chipset firmware arises from an integer overflow when alignments are used for memory allocation (CWE-190). It af…KEVEPSS 1.2%analysed7.8CVE-2018-14634Linux kernel create_elf_tables() integer overflow privilege escalationAn integer overflow in the Linux kernel's create_elf_tables() function lets an unprivileged local user escalate privileges when a SUID or otherwise p…KEVEPSS 15%analysed

Source: NIST National Vulnerability Database (record CVE-2021-31642), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.