CVE-2021-4473 - Vulnerability Analysis

Overview

Tianxin Internet Behavior Management System contains a command injection caused by crafted objClass parameter in Reporter component endpoint, letting unauthenticated attackers execute arbitrary commands and write malicious PHP files, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary commands and achieve remote code execution with web server privileges.

Mitigation

Update to version NACFirmware_4.0.0.7_20210716.180815_topsec_0_basic.bin or later.

References

• https://avd.aliyun.com/detail?id=AVD-2021-890232
• https://cn-sec.com/archives/4631959.html
• https://www.cnvd.org.cn/flaw/show/CNVD-2021-41972
• https://www.cnvd.org.cn/patchInfo/show/280166
• https://www.vulncheck.com/advisories/tianxin-internet-behavior-management-system-command-injection-via-toquery-php
• https://www.cve.org/CVERecord?id=CVE-2021-4473

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner