The Tianxin Internet Behavior Management System contains an OS command injection flaw in the Reporter component endpoint. By supplying a crafted objClass parameter that includes shell metacharacters and output redirection, an unauthenticated attacker can execute arbitrary system commands. This allows the attacker to write malicious PHP files into the web root and achieve remote code execution with the privileges of the web server process, resulting in full control over the affected device. The weakness is a classic command injection issue, identified as CWE‑78.

The flaw affects Beijing Topsec Network Security Technology Co., Ltd.'s Tianxin Internet Behavior Management System. While specific vulnerable firmware revisions are not listed, all releases prior to NACFirmware_4.0.0.7_20210716.180815_topsec_0_basic.bin are potentially impacted. The Reporter component, which processes the toQuery.php endpoint, is the entry point for exploitation.

The vulnerability is assessed with a CVSS score of 9.3, indicating critical severity. No EPSS score is available, and the flaw is not currently listed in the CISA KEV catalog. Exploitation is straightforward for an attacker with network access to the device, as it is unauthenticated and driven by simple HTTP requests to the Reporter endpoint. Public exploitation was observed by ShadowServer on June 1 2024, confirming real‑world risk.