An unauthenticated XSS vulnerability exists in several IoT devices from CHIYU Technology including BF-630 BF-450M BF-430 BF-431 BF631-W BF830-W Webpass BF-MINI-W and SEMAC due to a lack of sanitization when the HTTP 404 message is generated.