Description
A security flaw has been discovered in Tiandy Video Surveillance System 视频监控平台 7.17.0. This impacts the function downloadImage of the file /com/tiandy/easy7/core/bo/CLSBODownLoad.java. Performing a manipulation of the argument urlPath results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-02-23
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Server‑Side Request Forgery
Action: Assess Impact
AI Analysis

Impact

The flaw is a server‑side request forgery vulnerability in the downloadImage function of CLSBODownLoad.java in Tiandy Video Surveillance System 7.17.0. An attacker can manipulate the urlPath argument to cause the server to send HTTP requests to arbitrary addresses. This allows external resources to be fetched, potentially exposing internal network information or enabling further malicious activity. The vulnerability is classified as CWE‑918 and enables remote exploitation.

Affected Systems

This issue affects Tiandy Video Surveillance System (video monitoring platform) version 7.17.0. No other versions or vendors were listed as affected.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate risk. The EPSS score is below 1%, suggesting a low probability of real‑world exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack is remotely achievable by sending a crafted request to the downloadImage endpoint, where the attacker supplies a forged urlPath value. Successful exploitation would allow the server to reach arbitrary destinations, possibly exposing internal resources or executing further attack steps.

Generated by OpenCVE AI on April 17, 2026 at 16:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Verify whether Tiandy has released a patch for version 7.17.0 that addresses the SSRF issue; if available, apply the patch immediately.
  • Restrict the downloadImage endpoint so that the urlPath parameter only accepts legitimate internal URLs or relative paths; implement a whitelist or block all others to prevent arbitrary requests.
  • Limit the outgoing network connections from the surveillance system to the necessary services; apply firewall or network segmentation to block unexpected outbound traffic that could be triggered by SSRF.
  • Enable detailed logging of downloadImage requests and monitor logs for suspicious activity, enabling rapid detection of exploitation attempts.

Generated by OpenCVE AI on April 17, 2026 at 16:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 23 Feb 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Tiandy
Tiandy video Surveillance System
Vendors & Products Tiandy
Tiandy video Surveillance System

Mon, 23 Feb 2026 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 23 Feb 2026 10:45:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in Tiandy Video Surveillance System 视频监控平台 7.17.0. This impacts the function downloadImage of the file /com/tiandy/easy7/core/bo/CLSBODownLoad.java. Performing a manipulation of the argument urlPath results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title Tiandy Video Surveillance System 视频监控平台 CLSBODownLoad.java downloadImage server-side request forgery
Weaknesses CWE-918
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tiandy Video Surveillance System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T12:37:00.359Z

Reserved: 2026-02-22T16:48:08.502Z

Link: CVE-2026-2985

cve-icon Vulnrichment

Updated: 2026-02-23T12:36:46.333Z

cve-icon NVD

Status : Deferred

Published: 2026-02-23T11:16:39.770

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-2985

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T16:30:05Z

Weaknesses