CVE-2021-31250

What it actually does

This is a stored cross-site scripting vulnerability caused by insufficient input sanitization in web management components such as man.cgi, if.cgi, dhcpc.cgi, and ppp.cgi. A low-privileged authenticated attacker can submit malicious script content into device or application configuration fields; when another user, typically an administrator, later views the affected page, the script executes in that user’s browser context. Successful exploitation can expose session data, perform actions as the victim user, alter configuration, or support follow-on attacks against the management interface. The CVSS vector indicates network exploitability, low attack complexity, required low privileges, required user interaction, changed scope, and limited confidentiality and integrity impact. The high EPSS score and weaponized exploit maturity make this more urgent than the moderate CVSS score alone suggests.

Why it matters to the business

Exploitation can let an attacker manipulate administrative web sessions, change network or application settings, steal sensitive information displayed in the management UI, or use trusted administrator browsers to perform unauthorized actions. For internet-accessible or broadly reachable management interfaces, the operational risk includes unauthorized configuration changes, loss of trust in device administration, interruption of connectivity, and potential footholds for lateral movement. Although it is not listed in CISA KEV and is not known from the provided data to be used in ransomware campaigns, the exploit is weaponized and has a high exploitation probability, so exposed instances should be treated as a near-term remediation priority. The supplied affected-product metadata references MediaWiki packages and Git revisions, while the vulnerability description references CHIYU TCP/IP Converter device CGI components; teams should verify product applicability against authoritative vendor advisories before closing remediation based solely on package metadata.

How an attack unfolds

An attacker first obtains access to the affected web management interface with a low-privileged account or otherwise reaches an authenticated function that accepts user-controlled input. The attacker submits a crafted payload containing JavaScript or HTML event-handler code into one of the vulnerable CGI-backed configuration components, such as man.cgi, if.cgi, dhcpc.cgi, or ppp.cgi. Because the application does not properly sanitize or encode the value before storing and redisplaying it, the payload remains persistent. When an administrator or other privileged user opens the affected management page, the browser executes the attacker’s script under the trusted origin of the device or application. The script can then make same-origin requests, read page content available to the victim, change settings, submit forms, or send captured data to attacker-controlled infrastructure. In a mature attack, the adversary uses the victim’s administrative session to persist unauthorized configuration, weaken access controls, or stage additional actions through the management interface.

How to fix it

Apply the vendor-fixed release or firmware for the affected product. For the package metadata provided, MediaWiki on Debian 11, Debian 12, and Debian 13 is listed as fixed in version 1:1.35.2-1, and the Wikimedia MediaWiki Git fix is listed as commit ef13e11da4bcab62a8cc6f5459cd094e6881f326. Because the vulnerability description references CHIYU BF-430, BF-431, and BF-450M TCP/IP Converter devices, verify the correct vendor firmware or advisory for those devices and do not rely on unrelated package versions unless confirmed applicable. Where immediate patching is not possible, restrict access to the management interface to trusted administrative networks or VPNs, remove internet exposure, disable unused management services, enforce strong unique credentials, and require reauthentication for sensitive changes. Implement input validation, output encoding, and content security policy protections where configurable. Review and remove any suspicious stored values in affected configuration fields after patching, because stored XSS payloads may persist across upgrades if not cleaned.

How to confirm the fix worked

Confirm the installed software, package, or firmware version is at or above the vendor-fixed level. For the supplied MediaWiki metadata, verify Debian package version 1:1.35.2-1 or later, or verify that Git-based deployments include commit ef13e11da4bcab62a8cc6f5459cd094e6881f326. For CHIYU converter devices, validate against the vendor firmware version identified in the official advisory. After upgrading, test affected input fields with a harmless encoded probe such as a benign HTML tag or non-executing marker and confirm it is either rejected, safely encoded, or rendered inert. Inspect existing stored configuration values for script tags, HTML event handlers, javascript: URIs, encoded script markers, and unexpected external URLs. Confirm the management interface is not internet-exposed unless explicitly required and protected by compensating controls.

Typical attack path

1. Identify an exposed or reachable affected management interface or application instance.
2. Authenticate with a low-privileged account, reused credentials, default credentials, or another available access path.
3. Submit a stored XSS payload into a vulnerable input field handled by man.cgi, if.cgi, dhcpc.cgi, or ppp.cgi.
4. Wait for an administrator or privileged operator to view the affected page.
5. Execute JavaScript in the victim’s browser under the trusted application origin.
6. Use the victim’s session to read sensitive UI data, submit configuration changes, create or modify accounts where permitted, or exfiltrate data to attacker-controlled infrastructure.
7. Optionally remove obvious payloads or alter logs/configuration to reduce visibility.

How to detect it

To determine whether exploitation already occurred, review HTTP access logs, device management logs, reverse proxy logs, WAF logs, and authentication/session logs for suspicious POST or GET requests to man.cgi, if.cgi, dhcpc.cgi, and ppp.cgi containing script content, HTML event handlers, encoded angle brackets, javascript: URIs, or references to external domains. Inspect stored configuration values rendered by those components for persistent payloads, including URL-encoded or HTML-entity-encoded variants. Correlate suspicious submissions with subsequent administrator page views, unexpected configuration changes, new or modified accounts, altered network parameters, or session activity from unusual IP addresses. On administrator workstations, review browser history, proxy/DNS logs, and EDR network telemetry for outbound requests to unfamiliar domains immediately after access to the management interface. If exploitation is suspected, preserve logs and configuration exports before cleanup, remove malicious stored values, rotate affected credentials, and invalidate sessions.

• /man.cgi
• /if.cgi
• /dhcpc.cgi
• /ppp.cgi
• <script
• </script>
• %3Cscript
• %3C%2Fscript%3E
• javascript:
• %6A%61%76%61%73%63%72%69%70%74%3A
• onerror=
• onload=
• onclick=
• onmouseover=
• document.cookie
• document.domain
• XMLHttpRequest
• fetch(
• eval(
• atob(
• new Image()
• img src=x
• <svg
• %3Csvg
• <iframe
• %3Ciframe
• <body onload=
• String.fromCharCode

What your security team should do

• Prioritize discovery of internet-facing or broadly reachable management interfaces for the affected products and remove public exposure immediately where possible.
• Patch or upgrade affected systems to the applicable fixed version or vendor firmware; for the supplied package metadata, use MediaWiki 1:1.35.2-1 or later on Debian and include Git commit ef13e11da4bcab62a8cc6f5459cd094e6881f326 for source deployments where applicable.
• Validate the product mapping before closure, because the provided affected-product metadata and vulnerability description reference different product families.
• Search stored configuration fields and web logs for XSS payloads submitted to man.cgi, if.cgi, dhcpc.cgi, and ppp.cgi.
• Rotate credentials and invalidate active sessions for administrative users if suspicious payloads or configuration changes are found.
• Restrict administrative interfaces to trusted networks, enforce MFA where supported, and monitor for unusual configuration changes.
• Add SIEM detections for encoded and decoded script content in requests to the vulnerable CGI paths.
• Review administrator workstation telemetry for browser connections to unexpected external domains shortly after visiting affected management pages.