An unauthenticated command injection vulnerability in the Tianxin Internet Behavior Management System allows attackers to achieve remote code execution and is currently being exploited.

The Reporter component is susceptible to command injection via the "objClass" parameter. Unauthenticated attackers can inject shell metacharacters to execute arbitrary code as the web server process, potentially leading to the creation of malicious PHP files.

The CVSS score of 9.8 reflects the high severity of this flaw, which enables unauthenticated remote code execution. Successful exploitation can lead to total system takeover, unauthorized access to internal network traffic, and potential data exfiltration.

Immediate Action: Apply the vendor-provided firmware update (e.g., NACFirmware_4.0.0.7_20210716.180815_topsec_0_basic.bin) or contact the vendor for the latest security release.

Proactive Monitoring: Monitor for anomalous shell execution processes stemming from the web server and check the web root for unauthorized files.

Compensating Controls: Use a Web Application Firewall (WAF) to filter and block requests containing shell metacharacters or suspicious payloads directed at the Reporter component.

Public Exploit Available: Yes

This vulnerability is actively exploited and poses a critical threat to the security of the management system. Administrators should verify their current firmware version and apply the identified patch immediately to close this remote code execution vector.