CVE-2026-7698

Tiandy Easy7 Integrated Management Platform updateDbBackupInfo os command injection

View on CVE.org
Published May 3, 2026 CVSS 4.0 · 6.9 Medium EPSS 2.7% KEV · Not listed
Description
A vulnerability was identified in Tiandy Easy7 Integrated Management Platform 7.17.0. Affected by this vulnerability is an unknown functionality of the file /Easy7/rest/systemInfo/updateDbBackupInfo. Such manipulation of the argument week leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

A vulnerability exists in Tiandy Easy7 Integrated Management Platform 7.17.0, where an unvalidated 'week' argument in the /Easy7/rest/systemInfo/updateDbBackupInfo endpoint allows an attacker to inject operating‑system commands, leading to remote execution of arbitrary code. This flaw is identified as CWE‑77 and CWE‑78 and permits attackers to compromise the platform’s confidentiality, integrity, and availability without requiring local access.

Affected Systems

Tiandy Easy7 Integrated Management Platform version 7.17.0 is affected; the flaw resides in the /Easy7/rest/systemInfo/updateDbBackupInfo functionality. No other versions are currently documented as vulnerable.

Risk and Exploitability

With a CVSS score of 6.9, the vulnerability presents moderate severity, and the EPSS score of 1% indicates a small but non‑zero probability of exploitation. Publicly available exploits exist, indicating a realistic threat. It is not listed in the CISA KEV catalog. The attack is remote, likely delivered over HTTP to the vulnerable endpoint, and requires only control over the 'week' parameter to succeed.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any vendor‑issued security patch for the Easy7 Integrated Management Platform as soon as it is available.
  • Restrict the /Easy7/rest/systemInfo/updateDbBackupInfo endpoint so that only trusted administrators can access it, or disable the endpoint entirely if not needed.
  • Enforce strict input validation on the 'week' parameter, allowing only numeric values or values from an approved whitelist, to prevent command injection.
  • Consider network segmentation or firewall rules that block unexpected or high‑privilege command strings originating from the 'week' input.

Generated by OpenCVE AI on May 4, 2026 at 14:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Tiandy
Tiandy easy7 Integrated Management Platform
Vendors & Products Tiandy
Tiandy easy7 Integrated Management Platform
Type Values Removed Values Added
Description A vulnerability was identified in Tiandy Easy7 Integrated Management Platform 7.17.0. Affected by this vulnerability is an unknown functionality of the file /Easy7/rest/systemInfo/updateDbBackupInfo. Such manipulation of the argument week leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Tiandy Easy7 Integrated Management Platform updateDbBackupInfo os command injection
Weaknesses CWE-77
CWE-78
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
May 4, 2026, 1:03 PM
Reserved
May 2, 2026, 8:06 PM

View source JSON

Updated
May 4, 2026, 1:03 PM

JSON

Status
Deferred
Published
May 3, 2026, 2:16 PM
Modified
Oct 26, 2026, 8:10 PM

View source JSON

No data.

Updated
May 4, 2026, 2:45 PM

JSON