avd.aliyun.comThird-party advisory
https://avd.aliyun.com/detail?id=AVD-2021-890232 CVE-2021-4473
CRITICAL
Tianxin Internet Behavior Management System Command Injection via toQuery.php
Record summary
CVE-2021-4473 has a selected CVSS score of 9.3 (critical).
Description
Tianxin Internet Behavior Management System contains a command injection vulnerability in the Reporter component endpoint that allows unauthenticated attackers to execute arbitrary commands by supplying a crafted objClass parameter containing shell metacharacters and output redirection. Attackers can exploit this vulnerability to write malicious PHP files into the web root and achieve remote code execution with the privileges of the web server process. This vulnerability has been fixed in version NACFirmware_4.0.0.7_20210716.180815_topsec_0_basic.bin. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-06-01 (UTC).
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Apr 6, 2026 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 8, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Tianxin Internet Behavior Management SystemBrowse Beijing Topsec Network Security Technology Co., Ltd. / Tianxin Internet Behavior Management SystemDefault status: unaffected | CVE List, VulnCheck | Before 4.0.0.7_20210716.180815 | affected |
References
6cn-sec.comTechnical descriptionexploit
https://cn-sec.com/archives/4631959.html nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2021-4473 cnvd.org.cnGovernment resource
https://www.cnvd.org.cn/flaw/show/CNVD-2021-41972 cnvd.org.cnpatch
https://www.cnvd.org.cn/patchInfo/show/280166 vulncheck.comThird-party advisory
https://www.vulncheck.com/advisories/tianxin-internet-behavior-management-system-command-injection-via-toquery-php