Easy7 Integrated Management Platform CVE-2026-4585

Remote unauthenticated attacker can exploit Tiandy Easy7 Integrated Management Platform versions up to 7.17.0 by sending a crafted request with malicious input to the File parameter in /Easy7/apps/WebService/ImportSystemConfiguration.jsp. No victim interaction required; default configurations are vulnerable.

This vulnerability represents a critical real-world threat with a CVSS score of 9.8, characterized by network-based attack vector (AV:N), low complexity (AC:L), and no required privileges (PR:N) or user interaction (UI:N), enabling complete system compromise (C:H/I:H/A:H). The CVSS vector indicates Proof-of-concept exploit code exists (E:P) with no remediation level specified (RL:X) and reasonable report confidence (RC:R). The publicly available exploit documented at Feishu significantly lowers the barrier to exploitation, making this vulnerability immediately weaponizable. The lack of vendor response and unspecified remediation level (RL:X) indicates no official patch is available, elevating this from a theoretical to an imminent threat. Organizations using Tiandy Easy7 should treat this as a priority incident requiring immediate compensating controls, as the combination of maximum impact, zero authentication requirements, public exploit availability, and vendor silence creates an extremely dangerous exposure profile for internet-facing installations.

An unauthenticated attacker identifies an internet-exposed Tiandy Easy7 management platform and accesses the ImportSystemConfiguration.jsp endpoint. Using the publicly available proof-of-concept from the Feishu document (https://my.feishu.cn/docx/WkHjd3oajoIw5exHk9ecUHaFnKd), the attacker crafts a malicious request manipulating the 'File' parameter to inject OS commands, such as creating backdoor accounts, exfiltrating surveillance footage or configuration data, or pivoting to connected camera infrastructure and internal networks.