PT-2026-30817 · Tianxin · Tianxin Internet Behavior Management System

Published 2026-04-07 · Updated 2026-04-19 · CVE-2021-4473

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tianxin Internet Behavior Management System versions prior to NACFirmware 4.0.0.7 20210716.180815 topsec 0 basic.bin

Description The Tianxin Internet Behavior Management System contains a command injection vulnerability in the Reporter component endpoint. Unauthenticated attackers can execute arbitrary commands by supplying a crafted objClass parameter containing shell metacharacters and output redirection. This allows attackers to write malicious PHP files into the web root and achieve remote code execution with the privileges of the web server process. The Shadowserver Foundation first observed exploitation of this issue on 2024-06-01 (UTC).

Recommendations Update to version NACFirmware 4.0.0.7 20210716.180815 topsec 0 basic.bin

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-4473

Affected Products

Tianxin Internet Behavior Management System

References · 9

• 🔥 https://cn-sec.com/archives/4631959.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-4473 · Security Note
• https://cnvd.org.cn/patchInfo/show/280166 · Patch
• https://vulncheck.com/advisories/tianxin-internet-behavior-management-system-command-injection-via-toquery-php · Note
• https://twitter.com/ctiwatchcloud/status/2042996135862706257 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2041809627147579740 · Twitter Post
• https://twitter.com/CVEnew/status/2045972444972998853 · Twitter Post
• https://avd.aliyun.com/detail?id=AVD-2021-890232 · Note
• https://cnvd.org.cn/flaw/show/CNVD-2021-41972 · Note