Easy7 Integrated Management Platform CVE-2026-4187

The CVSS v3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) indicates a medium-severity vulnerability with several concerning characteristics: the network attack vector and low complexity make exploitation trivial for unskilled attackers, no privileges or user interaction are required, and the integrity impact is none while confidentiality impact is low and availability is unaffected. However, the EPSS proof-of-concept flag (E:P) and reported public exploit availability elevate real-world risk substantially. The exploitation maturity is marked as Proof-of-Concept (RL:X indicates reasonable confidence/unproven), suggesting active exploitation is likely given the public availability of exploit code. The vulnerability's impact is limited to confidentiality (information disclosure about device configurations), not system compromise or denial of service, yet the missing authentication aspect creates a gateway for further attacks. From an SSVC perspective, this vulnerability should be considered for immediate remediation in connected environments because: (1) the exploitation status is proof-of-concept/public, (2) the attack is automatable, (3) affected systems are network-exposed surveillance infrastructure with potential downstream critical impact, and (4) vendor non-responsiveness eliminates the patch option. Real-world priority depends heavily on whether the target organization has Tiandy Easy7 deployed in network-critical positions; for those organizations, this represents significant risk despite moderate CVSS scoring.

An attacker conducting reconnaissance on a network discovers a Tiandy Easy7 instance exposed to the internet on the standard HTTP port. The attacker crafts an HTTP request to /WebService/UpdateLocalDevInfo.jsp with manipulated username and password parameters (e.g., username=admin&password=dummy or parameter omission entirely). Due to missing authentication validation in the endpoint, the request succeeds, granting the attacker access to enumerate connected device information, retrieve device identifiers, and potentially update device configurations. The low attack complexity and lack of interaction requirements mean this can be exploited via simple curl commands or HTTP GET/POST requests without sophisticated tools. Public availability of proof-of-concept code means even unsophisticated attackers can weaponize this vulnerability at scale against any internet-exposed Tiandy Easy7 instances.