CVE-2021-4473

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-4473
Tianxin Internet Behavior Management System contains a command injection vulnerability in the Reporter component endpoint that allows unauthenticated attackers to execute arbitrary commands by supplying a crafted objClass parameter containing shell metacharacters and output redirection. Attackers can exploit this vulnerability to write malicious PHP files into the web root and achieve remote code execution with the privileges of the web server process. This vulnerability has been fixed in version NACFirmware_4.0.0.7_20210716.180815_topsec_0_basic.bin. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-06-01 (UTC).

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://avd.aliyun.com/detail?id=AVD-2021-890232 Third Party Advisory
https://cn-sec.com/archives/4631959.html Exploit Third Party Advisory
https://www.cnvd.org.cn/flaw/show/CNVD-2021-41972 Third Party Advisory
https://www.cnvd.org.cn/patchInfo/show/280166 Patch
https://www.vulncheck.com/advisories/tianxin-internet-behavior-management-system-command-injection-via-toquery-php Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:topsecgroup:tianxin_internet_behavior_management_system:*:*:*:*:*:*:*:*
History

24 Apr 2026, 15:12

Type Values Removed Values Added
First Time Topsecgroup
Topsecgroup tianxin Internet Behavior Management System
CPE cpe:2.3:a:topsecgroup:tianxin_internet_behavior_management_system:*:*:*:*:*:*:*:*
References () https://avd.aliyun.com/detail?id=AVD-2021-890232 - () https://avd.aliyun.com/detail?id=AVD-2021-890232 - Third Party Advisory
References () https://cn-sec.com/archives/4631959.html - () https://cn-sec.com/archives/4631959.html - Exploit, Third Party Advisory
References () https://www.cnvd.org.cn/flaw/show/CNVD-2021-41972 - () https://www.cnvd.org.cn/flaw/show/CNVD-2021-41972 - Third Party Advisory
References () https://www.cnvd.org.cn/patchInfo/show/280166 - () https://www.cnvd.org.cn/patchInfo/show/280166 - Patch
References () https://www.vulncheck.com/advisories/tianxin-internet-behavior-management-system-command-injection-via-toquery-php - () https://www.vulncheck.com/advisories/tianxin-internet-behavior-management-system-command-injection-via-toquery-php - Third Party Advisory, VDB Entry

07 Apr 2026, 13:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-07 13:16

Updated : 2026-04-24 15:12

NVD link : CVE-2021-4473

Mitre link : CVE-2021-4473

CVE.ORG link : CVE-2021-4473

JSON object : View

Products Affected

topsecgroup

  • tianxin_internet_behavior_management_system
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')