Tiandy Easy7 CVE-2026-9465

No authentication is required (CVSS 4.0 PR:N) and no user interaction is needed (UI:N). The sole prerequisite is network reachability of the /Easy7/apps/WebService/GetDBDataEx.jsp endpoint - exploitation succeeds against any Easy7 7.17.0 instance where this JSP is accessible over the network. Attack complexity is low (AC:L) with no additional attack requirements (AT:N), meaning no race conditions, no specific configuration state, and no timing dependencies are needed. Exploitation is limited in blast radius by the CVSS impact scope: only the vulnerable system's database is affected (SC:N), and impacts are partial rather than full compromise (VC:L/VI:L/VA:L). The most significant limiting factor is deployment exposure: Easy7 is an industrial surveillance platform typically deployed on internal networks, so internet-facing instances may represent a minority of deployments. Defenders should verify whether the GetDBDataEx.jsp endpoint is exposed beyond trusted network segments.

The CVSS 4.0 score of 5.5 reflects a medium-severity finding with partial confidentiality, integrity, and availability impact limited to the vulnerable system (VC:L/VI:L/VA:L) and no downstream or subsequent system impact (SC:N/SI:N/SA:N). However, the attack conditions are highly favorable for an attacker: no authentication, no complexity barriers, and no user interaction required. Against this, the EPSS score of 0.03% (8th percentile) suggests that widespread automated exploitation has not been observed historically across similar vulnerabilities, though this is a low-profile industrial/IoT platform where telemetry is sparse. The SSVC assessment contradicts the low EPSS in a meaningful way - SSVC classifies this as Automatable: yes with a poc exploitation status, meaning an attacker can reliably script exploitation at scale without manual effort. This divergence (low EPSS but automatable POC) likely reflects limited internet exposure of Easy7 deployments rather than a difficult-to-exploit vulnerability. The absence of a KEV listing means confirmed in-the-wild exploitation has not been reported to CISA. Net assessment: medium-high operational priority for any organization with internet-facing Easy7 instances, given the zero-friction exploitation path and public POC.

An unauthenticated remote attacker sends a crafted HTTP GET or POST request to the publicly accessible /Easy7/apps/WebService/GetDBDataEx.jsp endpoint with a SQL payload embedded in the strTBName parameter - for example, injecting a UNION SELECT statement or Boolean-based blind payload. Because no authentication or special session state is required, the attack is fully automatable and can enumerate database tables, extract credentials, or modify records depending on the database user's permissions. A public exploit has been disclosed at https://ucn9h68n9289.feishu.cn/wiki/MOEfw7m4xiwxifkGWwDcNzEPnD0, lowering the skill threshold for exploitation.