Is there a public PoC exploit available for CVE-2026-9466?

Yes, a public proof-of-concept exploit is available for CVE-2026-9466. Prioritise patching immediately. EPSS: 0.0%.

Tiandy Easy7 CVE-2026-9466

Q: What is the CVSS score of CVE-2026-9466?

CVE-2026-9466 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31698 MEDIUM

Weak Password Recovery Mechanism for Forgotten Password (CWE-640)

2026-05-25 VulDB

GHSA-7frc-fvv8-6vw2

Information Disclosure Easy7 Integrated Management Platform

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:28 vuln.today

CVSS changed

May 26, 2026 - 20:07 NVD

5.3 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was determined in Tiandy Easy7 Integrated Management Platform 7.17.0. This issue affects some unknown processing of the file /rest/user/updateUserPassword of the component API Endpoint. Executing a manipulation can lead to weak password recovery. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Weak password recovery in Tiandy Easy7 Integrated Management Platform 7.17.0 exposes the /rest/user/updateUserPassword API endpoint to unauthenticated remote manipulation, enabling an attacker to interfere with the password update process and achieve unauthorized integrity impact on user credentials (CWE-640). The CVSS 4.0 vector confirms unauthenticated network access with no prerequisites, and a public exploit has been disclosed via Feishu documentation. Despite the public POC, EPSS sits at 0.03% (8th percentile), indicating no widespread automated exploitation has been observed; the vendor did not respond to coordinated disclosure, leaving the flaw unpatched.

Technical ContextAI

The affected component is the REST API endpoint /rest/user/updateUserPassword within Tiandy Easy7 Integrated Management Platform 7.17.0 (CPE: cpe:2.3:a:tiandy:easy7_integrated_management_platform:*:*:*:*:*:*:*:*). CWE-640 (Weak Password Recovery Mechanism for Forgotten Password) describes flaws where a password reset or update flow fails to adequately verify the identity of the requesting party - common manifestations include missing authentication tokens, predictable or reusable reset tokens, missing server-side validation of the requesting user's identity, or unauthenticated invocation of the update endpoint itself. The CVSS 4.0 vector (PR:N, AT:N, AC:L) confirms that no authentication, no special attack configuration, and no elevated complexity are required, strongly suggesting the endpoint accepts password change requests without verifying ownership of the account being modified.

RemediationAI

No vendor-released patch has been identified at time of analysis - Tiandy did not respond to coordinated disclosure, so no official fix version exists to cite. Organizations should treat this as an unpatched vulnerability requiring compensating controls. The most effective immediate mitigation is to restrict network access to the /rest/user/updateUserPassword API endpoint via WAF rules, reverse proxy ACLs, or firewall policy, allowing only authenticated internal traffic to reach it - note this does not fix the underlying authentication bypass but raises the bar for exploitation. If the platform is internet-facing, it should be placed behind a VPN or network perimeter requiring authentication before API access is permitted. Monitor API logs for anomalous calls to /rest/user/updateUserPassword that originate outside expected user sessions. If the password recovery/update feature is not operationally required, consider disabling it at the application or network layer. Organizations should follow VulDB advisory updates at https://vuldb.com/vuln/365447 and the EUVD entry EUVD-2026-31698 for any vendor-issued patch.