Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Tianxin Internet Behavior Management System contains a command injection vulnerability in the Reporter component endpoint that allows unauthenticated attackers to execute arbitrary commands by supplying a crafted objClass parameter containing shell metacharacters and output redirection. Attackers can exploit this vulnerability to write malicious PHP files into the web root and achieve remote code execution with the privileges of the web server process. This vulnerability has been fixed in version NACFirmware_4.0.0.7_20210716.180815_topsec_0_basic.bin. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-06-01 (UTC).
Priority
MEDIUM
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-07 | 2 | Disclosure1Patch1 |
| 2026-04-08 | 1 | Active Exploitation1 |
| 2026-04-11 | 1 | Active Exploitation1 |
| 2026-04-19 | 1 | Disclosure1 |
CVE-2021-4473 Tianxin Internet Behavior Management System contains a command injection vulnerability in the Reporter component endpoint that allows unauthenticated attackers to execu… https://www.cve.org/CVERecord?id=CVE-2021-4473
Post summary
The text announces CVE‑2021‑4473, describing a command injection vulnerability in the Reporter component that can be exploited without authentication.
🚨 [CRITICAL] Active exploitation detected: CVE-2021-4473 Exploit in the wild confirmed for CVE-2021-4473 (CVSS 9.8). Tianxin Internet Behavior Management System contains a command injection vulnerability in ... 🔗 http://ctiwatch.cloud/alerts #ZeroDay #ExploitInWild #CyberSecurity
Post summary
The alert indicates that CVE‑2021‑4473, a high‑severity command injection vulnerability, is actively exploited in the wild. No patch details or PoC information are included in the text.
Shadowserver warns of active exploitation of CVE-2021-4473 in Tianxin systems. This 9.3 CVSS flaw allows unauthenticated RCE. Patch your firmware immediately! #ActiveExploit #TianxinRCE #CVE #CyberSecurity #InfoSec #RCE #NetworkSecurity #Shadowserver https://securityonline.info/tianxin-internet-behavior-management-active-exploit-cve-2021-4473/ https://t.co/hO0kRN68J2
Post summary
Shadowserver reports that CVE-2021-4473 is actively exploited in Tianxin systems, citing a 9.3 CVSS score and unauthenticated RCE, and urges users to patch firmware promptly.
[CVE-2021-4473: CRITICAL] Tianxin Internet Behavior Management System had a command injection vulnerability, now fixed in version NACFirmware_4.0.0.7_20210716. Exploitation evidence found by Shadowserver Found...#cve,CVE-2021-4473,#cybersecurity https://cvefind.com/CVE-2021-4473
Post summary
The post highlights a critical command‑injection flaw in Tianxin Internet Behavior Management System, confirms it has been patched in firmware version 4.0.0.7_20210716, and notes that Shadowserver has found exploitation evidence in the wild.
🚨 CVE-2021-4473: Tianxin Internet Behavior Managem... Unauthenticated RCE via shell metacharacters in objClass param - perfect for dropping webshells on Chinese enterprise ne... https://zerodaysignal.com/vulnerability/CVE-2021-4473 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces CVE‑2021‑4473, noting an unauthenticated remote code execution flaw involving shell metacharacters in the objClass parameter, and provides a link to a zero‑day signal page for further details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | topsecgroup | tianxin_internet_behavior_management_system | - | - | - |