Command Injection Vulnerability in Tianxin Internet Behavior Management System by Tianxin
CVE-2021-4473

9.3CRITICAL

Key Information:

Vendor: Beijing Topsec Network Security Technology Co., Ltd.
Status: Tianxin Internet Behavior Management System
Vendor: CVE Published:; 7 April 2026

🔔 Create Beijing Topsec Network Security Technology Co., Ltd. Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2021-4473?

The Tianxin Internet Behavior Management System has a command injection vulnerability within its Reporter component. This issue allows unauthenticated attackers to execute arbitrary commands by manipulating the objClass parameter with crafted shell metacharacters and output redirection. If exploited, attackers could write malicious PHP files to the web root, leading to remote code execution under the web server's privileges. The vulnerability has been mitigated in version NACFirmware_4.0.0.7_20210716.180815_topsec_0_basic.bin, with exploitation attempts first recorded on June 1, 2024, as observed by the Shadowserver Foundation.

Affected Version(s)

Tianxin Internet Behavior Management System 0 < 4.0.0.7_20210716.180815

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2021-4473 - Proof of Concept