TI-2021-03329 Aliases CVE-2021-4473 GHSA-qr68-g3cq-vhr2

Tianxin Internet Behavior Management System Command Injection via toQuery.php

MEDIUM 57CWE-78Published 2026-04-07 · Updated 2026-05-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Tianxin Internet Behavior Management System contains a command injection vulnerability in the Reporter component endpoint that allows unauthenticated attackers to execute arbitrary commands by supplying a crafted objClass parameter containing shell metacharacters and output redirection. Attackers can exploit this vulnerability to write malicious PHP files into the web root and achieve remote code execution with the privileges of the web server process. This vulnerability has been fixed in version NACFirmware_4.0.0.7_20210716.180815_topsec_0_basic.bin. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-06-01 (UTC).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.06272 93rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix Fixed Tianxin Internet Behavior Management System (Beijing Topsec Network Security Technology Co., Ltd.): 4.0.0.7_20210716.180815

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Beijing Topsec Network Security Technology Co., Ltd.	Tianxin Internet Behavior Management System	before 4.0.0.7_20210716.180815	4.0.0.7_20210716.180815	Patch available	CNA

Tianxin Internet Behavior Management System VendorBeijing Topsec Network Security Technology Co., Ltd. Affected before 4.0.0.7_20210716.180815 Fixed in 4.0.0.7_20210716.180815 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:topsecgroup:tianxin_internet_behavior_management_system::::::::	before 4.0.0.7_20210716.180815	Vulnerable	Topsecgroup

cpe:2.3:a:topsecgroup:tianxin_internet_behavior_management_system:*:*:*:*:*:*:*:* Versions before 4.0.0.7_20210716.180815 Vulnerable ·Topsecgroup

Remediation

Fix · CNA Tianxin Internet Behavior Management System (Beijing Topsec Network Security Technology Co., Ltd.) Fixed in 4.0.0.7_20210716.180815

Timeline

2026-10-02 Threatist record created from CVE-2021-4473
2026-10-03 Alias added: GHSA-qr68-g3cq-vhr2

References

Exploit 1

https://cn-sec.com/archives/4631959.html

Patch 1

https://www.cnvd.org.cn/patchInfo/show/280166

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences