CVE-2021-4473

Katalog CVE

CVSS 9.8 · Critical EPSS 6,2%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada topsecgroup tianxin internet behavior management system. Skor CVSS 3.1 9.8 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

Tianxin Internet Behavior Management System contains a command injection vulnerability in the Reporter component endpoint that allows unauthenticated attackers to execute arbitrary commands by supplying a crafted objClass parameter containing shell metacharacters and output redirection. Attackers can exploit this vulnerability to write malicious PHP files into the web root and achieve remote code execution with the privileges of the web server process. This vulnerability has been fixed in version NACFirmware_4.0.0.7_20210716.180815_topsec_0_basic.bin. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-06-01 (UTC).

Rincian

Terbit di NVD

7 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

6,2% peluang dieksploitasi; lebih tinggi dari 93,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cnvd.org.cn/patchInfo/show/280166 patch
• https://avd.aliyun.com/detail?id=AVD-2021-890232 advisory pihak ketiga
• https://cn-sec.com/archives/4631959.html exploit · advisory pihak ketiga
• https://www.cnvd.org.cn/flaw/show/CNVD-2021-41972 advisory pihak ketiga
• https://www.vulncheck.com/advisories/tianxin-internet-behavior-management-system-command-injection-via-toquery... advisory pihak ketiga · vdb entry