CVE-2026-7698mediumCWE-77CWE-78

CVE-2026-7698: medium-severity vulnerability in Tiandy Easy7 Integrated Management Platform

Tiandy Easy7 Integrated Management Platform updateDbBackupInfo os command injection

Published · Updated

Follow this CVE+ Monitor Easy7 Integrated Management Platform

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.9epss 2.7%
A vulnerability was identified in Tiandy Easy7 Integrated Management Platform 7.17.0. Affected by this vulnerability is an unknown functionality of the file /Easy7/rest/systemInfo/updateDbBackupInfo. Such manipulation of the argument week leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
Tiandy · Easy7 Integrated Management Platform
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Tiandy Easy7 Integrated Management Platform

In the same product, most dangerous first.

CVE-2026-4585CRITICALTiandy Easy7 Integrated Management Platform Configuration ImportSystemConfiguration.jsp os command injectionEPSS 4.6%CVE-2026-4187MEDIUMTiandy Easy7 Integrated Management Platform Device Identifier UpdateLocalDevInfo.jsp missing authenticationEPSS 0.6%CVE-2026-9466MEDIUMTiandy Easy7 Integrated Management Platform API Endpoint updateUserPassword password recoveryEPSS 0.4%CVE-2026-9465MEDIUMTiandy Easy7 Integrated Management Platform GetDBDataEx.jsp sql injectionEPSS 0.3%CVE-2026-4221MEDIUMTiandy Easy7 Integrated Management Platform Endpoint uploadLedImage unrestricted uploadEPSS 0.3%CVE-2026-4289MEDIUMTiandy Easy7 Integrated Management Platform getRecByTemplateId sql injectionEPSS 0.3%