EUVD-2026-12357Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to /rest/file/uploadLedImage
-
ExploitUpload malicious file without validation
-
ImpactExecute arbitrary code via uploaded file
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Tiandy Easy7 Integrated Management Platform version 7.17.0 with /rest/file/uploadLedImage endpoint accessible. No authentication required; remote unauthenticated exploitation possible against default installations. |
| Impact | This vulnerability presents a significant real-world risk based on multiple factors: The CVSS score of 7.3 (High) reflects network-based attacks requiring no authentication or user interaction (AV:N/AC:L/PR:N/UI:N). The CVSS E:P metric confirms a proof-of-concept exists. While not currently in CISA KEV, the public availability of exploit code combined with the vendor's non-response makes this a priority risk. The attack is automatable and can lead to full system compromise through arbitrary file upload and potential code execution. The lack of vendor response or patches further elevates the risk as affected systems remain vulnerable indefinitely. |
| Exploit ScenarioDerived | An attacker can remotely access the vulnerable /rest/file/uploadLedImage endpoint without any authentication and upload a malicious file, such as a web shell or executable. Since the application fails to validate file types or content, the attacker could upload a PHP/JSP shell disguised as an image file. Once uploaded, the attacker can access the uploaded file through the web server to execute arbitrary commands, potentially gaining full control of the server. The publicly available proof-of-concept at https://my.feishu.cn/docx/Z5HJdLCxioFs4sxyILbcoSIAnTh demonstrates this attack methodology, making it trivial for even low-skilled attackers to exploit vulnerable systems. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
An unrestricted file upload vulnerability exists in the Tiandy Easy7 Integrated Management Platform version 7.17.0, specifically in the /rest/file/uploadLedImage endpoint. This vulnerability allows remote attackers without authentication to upload arbitrary files, potentially leading to remote code execution. A proof-of-concept exploit has been publicly released and the vendor has not responded to disclosure attempts, leaving this vulnerability unpatched and actively exploitable.
RemediationAI
No official patch is available as the vendor has not responded to vulnerability disclosure. Immediate mitigation steps include: 1) Restrict network access to the /rest/file/uploadLedImage endpoint through firewall rules or web application firewall, 2) Implement authentication requirements for file upload functionality if possible through reverse proxy, 3) Monitor for suspicious file uploads and unusual activity on affected systems, 4) Consider disabling the LED image upload feature if not business-critical, 5) Isolate affected systems from critical infrastructure until a patch becomes available. Organizations should monitor vendor channels for future security updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects the Tiandy Easy7 Integrated Management Platform (CPE: cpe:2.3:a:tiandy:easy7_integrated_management_platform:*:*:*:*:*:*:*:*), which appears to be a security/surveillance management system. The flaw is categorized as CWE-434 (Unrestricted Upload of File with Dangerous Type), occurring in the LED image upload functionality at the /rest/file/uploadLedImage endpoint. This type of vulnerability typically occurs when applications fail to properly validate file types, extensions, or content before accepting uploads, allowing attackers to upload executable files or scripts that can be later executed on the server.
Know when Easy7 Integrated Management Platform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in Tiandy Easy7 Integrated Management Platform 7.17.0. This affects an unknown part of the file /rest/file/uploadLedImage of the component Endpoint. The manipulation of the argument File results in unrestricted upload. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Tiandy Easy7 Integrated Management Platform version 7.17.0 contains a critical, actively exploited file upload vulnerability that allows unauthenticated attackers to execute arbitrary code on affected systems. Organizations running this platform face immediate risk of complete system compromise, data theft, and operational disruption without remediation.
Implement Web Application Firewall (WAF) rules to block or rate-limit requests to /rest/file/uploadLedImage endpoint; segment network access to restrict connection sources to the affected platform; deploy runtime application self-protection (RASP) if available; enforce strict file upload validation at network boundary; monitor authentication logs and file upload activities for suspicious patterns; consider disabling the file upload feature if operationally feasible; maintain enhanced monitoring and incident response readiness given active exploit availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Related Vulnerabilities in Tiandy and Integrated Management Platform Upload
View all 2A critical OS command injection vulnerability exists in Tiandy Easy7 Integrated Management Platform versions up to 7.17.
OS command injection in Tiandy Easy7 Integrated Management Platform 7.17.0 allows remote unauthenticated attackers to ex
Tiandy Easy7 Integrated Management Platform 7.17.0 contains an authentication bypass in the Device Identifier Handler co
Weak password recovery in Tiandy Easy7 Integrated Management Platform 7.17.0 exposes the `/rest/user/updateUserPassword`
Unauthenticated SQL injection in Tiandy Easy7 Integrated Management Platform 7.17.0 exposes database contents to remote
SQL injection in Tiandy Easy7 Integrated Management Platform versions up to 7.17.0 allows unauthenticated remote attacke
Tiandy Easy7 Integrated Management Platform 7.17.0 contains an SQL injection vulnerability in the /rest/devStatus/getDev
GitHub PoC
Exploit-DB