CVE-2026-4170 — AI Deep Analysis Summary

🚨 **Essence**: OS Command Injection in TOPSEC TopACM. <br>💥 **Consequences**: Attackers can execute arbitrary system commands on the target server.…

🛡️ **CWE**: CWE-78 (Improper Neutralization of Special Elements used in an OS Command).…

🏢 **Vendor**: Topsec (China Tianrongxin). <br>📦 **Product**: TOPSEC TopACM (Application Access Control & Security Management System). <br>📅 **Affected Version**: Specifically **Version 3.0**.…

👑 **Privileges**: The injected commands likely execute with the privileges of the web service account (often root or high-privilege user in such appliances).…

⚡ **Threshold**: **LOW**. <br>🔓 **Auth**: CVSS Vector `PR:N` indicates **No Privileges Required**. <br>🌐 **Access**: `AV:N` means it is exploitable over the **Network**.…

📢 **Public Exploit**: Yes. <br>🔗 **Evidence**: References include a Feishu doc tagged as 'exploit' and VDB entries (VDB-351077) detailing the HTTP request for `nmc_sync.php`.…

🔍 **Self-Check**: <br>1. Scan for the specific endpoint: `/view/systemConfig/management/nmc_sync.php`. <br>2. Look for HTTP requests containing the `template_path` parameter. <br>3.…

🩹 **Official Fix**: The data implies a fix is available or advisory is issued (VDB submission exists). <br>📝 **Action**: Contact Topsec support immediately.…

🛑 **No Patch Workaround**: <br>1. **Network Segmentation**: Isolate the TopACM management port from the public internet. <br>2.…

🔥 **Urgency**: **CRITICAL**. <br>📊 **CVSS Score**: 9.8 (Critical). <br>⏳ **Priority**: **Immediate Action Required**. <br>🚨 Since it is unauthenticated and remote, automated scanners and bots will likely target this.…