Which versions of Easy7 Integrated Management Platform are affected by CVE-2026-4187?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4187, a missing authentication vulnerability rated CVSS 5.3.

Is there a public PoC exploit available for CVE-2026-4187?

Yes, a public proof-of-concept exploit is available for CVE-2026-4187. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-4187?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Audit authentication configurations.

Easy7 Integrated Management Platform CVE-2026-4187

Q: What is the CVSS score of CVE-2026-4187?

CVE-2026-4187 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-12245 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-03-15 VulDB

Authentication Bypass Easy7 Integrated Management Platform

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 22, 2026 - 21:37 NVD

5.3 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 15, 2026 - 20:00 euvd

EUVD-2026-12245

Analysis Generated

Mar 15, 2026 - 20:00 vuln.today

CVE Published

Mar 15, 2026 - 19:02 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was identified in Tiandy Easy7 Integrated Management Platform 7.17.0. Impacted is an unknown function of the file /WebService/UpdateLocalDevInfo.jsp of the component Device Identifier Handler. Such manipulation of the argument username/password leads to missing authentication. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Tiandy Easy7 Integrated Management Platform 7.17.0 contains an authentication bypass in the Device Identifier Handler component that allows unauthenticated remote attackers to manipulate username and password parameters via the /WebService/UpdateLocalDevInfo.jsp endpoint. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor.

Technical ContextAI

The vulnerability resides in the Device Identifier Handler component of Tiandy Easy7, a video surveillance and integrated management platform commonly deployed in industrial and commercial security infrastructure. The affected endpoint /WebService/UpdateLocalDevInfo.jsp appears to be a JSP-based web service designed to update local device information, likely for remote device management functionality. The root cause is classified under CWE-306 (Missing Authentication for Critical Function), indicating that the application fails to enforce proper authentication controls on a critical function that should be protected. The JSP-based architecture suggests this is a Java-based web application, and the parameter manipulation attack vector indicates that input validation and authentication logic are decoupled or improperly implemented, allowing attackers to manipulate username/password arguments without actually providing valid credentials. The vulnerability's network-accessible nature (AV:N) and low attack complexity (AC:L) indicate that the authentication bypass does not require special conditions or user interaction.

RemediationAI

Immediate patching is the primary remediation; however, given Tiandy's non-responsive disclosure status, users should contact Tiandy support directly to inquire about security patches for version 7.17.0 or consider upgrading to the latest available version if patches are not provided. In the interim, implement network-level compensating controls: restrict access to the /WebService/UpdateLocalDevInfo.jsp endpoint to trusted internal networks only using firewall rules or reverse proxy access control lists; deploy the application behind a reverse proxy that enforces mutual TLS (mTLS) authentication before traffic reaches the application; disable or remove the /WebService/UpdateLocalDevInfo.jsp endpoint entirely if remote device updates are not operationally necessary; implement network segmentation to isolate Tiandy Easy7 infrastructure from internet-facing networks; and enable detailed logging and monitoring of all access attempts to the vulnerable endpoint to detect exploitation attempts. If vendor patches become available, apply them immediately. Organizations should also audit recent access logs for unauthorized device information access or manipulation of device configurations.