CVE-2021-4473 PUBLISHED

Tianxin Internet Behavior Management System Command Injection via toQuery.php

Assigner: VulnCheck
Reserved: 15.01.2026 Published: 07.04.2026 Updated: 07.04.2026

Tianxin Internet Behavior Management System contains a command injection vulnerability in the Reporter component endpoint that allows unauthenticated attackers to execute arbitrary commands by supplying a crafted objClass parameter containing shell metacharacters and output redirection. Attackers can exploit this vulnerability to write malicious PHP files into the web root and achieve remote code execution with the privileges of the web server process. This vulnerability has been fixed in version NACFirmware_4.0.0.7_20210716.180815_topsec_0_basic.bin. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-06-01 (UTC).

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.3

Product Status

Vendor Beijing Topsec Network Security Technology Co., Ltd.
Product Tianxin Internet Behavior Management System
Versions Default: unaffected
  • affected from 0 to 4.0.0.7_20210716.180815 (excl.)

Credits

  • The Shadowserver Foundation reporter

References

Problem Types

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE