CVE-2021-4473: Topsecgroup Tianxin Internet Behavior Management System remote code execution (CVSS 9.8)

Description

Tianxin Internet Behavior Management System contains a command injection vulnerability in the Reporter component endpoint that allows unauthenticated attackers to execute arbitrary commands by supplying a crafted objClass parameter containing shell metacharacters and output redirection. Attackers can exploit this vulnerability to write malicious PHP files into the web root and achieve remote code execution with the privileges of the web server process. This vulnerability has been fixed in version NACFirmware_4.0.0.7_20210716.180815_topsec_0_basic.bin. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-06-01 (UTC).

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Topsecgroup Tianxin Internet Behavior Management System< 4.0.0.7_20210716.180815

Remediation

Fixed in

Topsecgroup Tianxin Internet Behavior Management System≥ 4.0.0.7_20210716.180815

Patch & vendor advisories

https://www.cnvd.org.cn/patchInfo/show/280166

References

https://avd.aliyun.com/detail?id=AVD-2021-890232Third Party Advisory
https://cn-sec.com/archives/4631959.htmlExploitThird Party Advisory
https://www.cnvd.org.cn/flaw/show/CNVD-2021-41972Third Party Advisory
https://www.cnvd.org.cn/patchInfo/show/280166Patch
https://www.vulncheck.com/advisories/tianxin-internet-behavior-management-system-command-injection-via-toquery-phpThird Party AdvisoryVDB Entry

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2021-4473 being actively exploited?

CVE-2021-4473 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 6.17%.

How severe is CVE-2021-4473?

CVE-2021-4473 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 6.17% probability of exploitation.

Which products are affected by CVE-2021-4473?

Affected products include Topsecgroup Tianxin Internet Behavior Management System.

How do I fix CVE-2021-4473?

Upgrade affected software to a fixed version, for example Topsecgroup Tianxin Internet Behavior Management System 4.0.0.7_20210716.180815 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2021-4473 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo