CVE-2021-31641: An unauthenticated XSS vulnerability exists in several IoT devices from CHIYU Technology, including BF-630,...

Security readout for executives and security teams

CVE-2021-31641 is an unauthenticated cross-site scripting flaw in multiple CHIYU Technology IoT access-control devices. A malformed request that triggers the device HTTP 404 page may cause unsanitized content to run in a user's browser. The source bundle does not provide a CVSS score or confirmed active exploitation. Exposure is most relevant where CHIYU device web interfaces are reachable by operators, administrators, internal users, or the internet. Because exact versions and firmware ranges are not provided in the source bundle, asset identification should focus on the named models and vendor firmware guidance. Prioritize discovery and exposure reduction, especially for externally reachable access-control devices. The flaw is not KEV-listed in the provided bundle and lacks severity scoring, but unauthenticated XSS on physical security infrastructure warrants timely validation and vendor follow-up. Mitigation focus: Inventory the named CHIYU device models across networks and remote sites.; Check CHIYU firmware guidance for applicable updates or replacement instructions.; Restrict device web interfaces to trusted management networks or VPN access..

Prepared

Jun 2, 2026, 19:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.