Tiandy Easy7 CVE-2026-9466

No special conditions are required for initial exploitation - the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated exploitation against the /rest/user/updateUserPassword endpoint of Tiandy Easy7 7.17.0 with no user interaction. The primary prerequisite is that the API endpoint is network-reachable (i.e., not blocked by a firewall or reverse proxy requiring prior authentication). Limiting factors include: the VI:L integrity impact scope - the attacker can manipulate a user's password but gains no direct code execution, confidentiality access, or availability impact from this flaw alone; the exploit requires knowing or guessing a valid username or account identifier to target; and the platform's relatively limited global deployment reduces opportunistic attack surface compared to commodity software. Exploitation is not constrained to any specific OS, browser, or non-default configuration beyond network reachability.

The CVSS 4.0 base score of 5.5 with vector AV:N/AC:L/AT:N/PR:N/UI:N reflects a remotely exploitable, unauthenticated flaw requiring no interaction - a broad attack surface. However, impact is constrained to low integrity on the vulnerable system (VI:L) with no confidentiality or availability impact and no lateral scope change, which appropriately moderates the score. The E:P modifier (proof of concept exists) elevates practical concern beyond a theoretical flaw. Against these signals, the EPSS score of 0.03% (8th percentile) sharply contrasts: despite a public exploit, mass automated exploitation has not materialized, consistent with a product that may have limited internet-facing deployment globally. This vulnerability is not listed in CISA KEV, confirming no verified active exploitation campaign. The real-world risk tier is medium for organizations running Tiandy Easy7 in network-accessible configurations - account takeover via unauthenticated password manipulation is a meaningful threat even at low impact-severity ratings, particularly for surveillance or physical security platforms where credential compromise has physical consequences. No conflicting CVSS signal is present, though the CPE wildcard version range ('*') means affected version boundaries beyond 7.17.0 are not independently confirmed.

An unauthenticated remote attacker identifies a Tiandy Easy7 7.17.0 instance accessible over the network and sends a crafted HTTP request to the /rest/user/updateUserPassword endpoint, exploiting the missing or bypassable authentication check to submit a password change for a target account without possessing the current credential. A public exploit demonstrating this technique has been disclosed at the referenced Feishu wiki link, lowering attacker skill requirements significantly.