CVE-2021-4473

moderate-risk

Published 2026-04-07

Tianxin Internet Behavior Management System contains a command injection vulnerability in the Reporter component endpoint that allows unauthenticated attackers to execute arbitrary commands by supplying a crafted objClass parameter containing shell metacharacters and output redirection. Attackers can exploit this vulnerability to write malicious PHP files into the web root and achieve remote code execution with the privileges of the web server process. This vulnerability has been fixed in version NACFirmware_4.0.0.7_20210716.180815_topsec_0_basic.bin. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-06-01 (UTC).

Do I need to act?

5.4% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (1)

Tianxin Internet Behavior Management System

Affected Vendors

Topsecgroup

References (5)

Third Party Advisory https://avd.aliyun.com/detail?id=AVD-2021-890232

Exploit https://cn-sec.com/archives/4631959.html

Third Party Advisory https://www.cnvd.org.cn/flaw/show/CNVD-2021-41972

Patch https://www.cnvd.org.cn/patchInfo/show/280166

Third Party Advisory https://www.vulncheck.com/advisories/tianxin-internet-behavior-management-system...

/ 100

moderate-risk

Severity 32/34 · Critical

Exploitability 8/34 · Low

Exposure 5/34 · Minimal