The vulnerability exists in the Tiandy Easy7 Integrated Management Platform 7.17.0 and allows an attacker to upload files via the /rest/file/uploadLedImage endpoint without restriction. This unrestricted file upload (CWE‑434) also represents an improper access control issue (CWE‑284), giving the threat actor the ability to place arbitrary files on the device. If the server processes these files, the attacker could achieve remote code execution or elevate privileges, compromising confidentiality, integrity, and availability of the system.

The flaw is specific to Tiandy Easy7 Integrated Management Platform version 7.17.0. No other versions or products are currently listed as affected in the CNA data. Users running this exact version should verify whether their deployment contains the /rest/file/uploadLedImage endpoint and assess exposure.

The CVSS base score is 6.9, indicating a moderate severity, while the EPSS score is below 1%, suggesting a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed productive exploitation in the wild. However, the publicly available exploit means an attacker could target the remote HTTP endpoint, bypass input validation and upload arbitrary content, potentially leading to malicious code execution or denial of service. The risk is therefore moderate to high for environments where the endpoint is exposed to untrusted networks.