Tiandy Easy7 Management Platform EUVD-2026-26836

Remote unauthenticated exploitation of the /Easy7/rest/systemInfo/updateDbBackupInfo REST endpoint with no special configuration required - the vulnerable functionality is active in default Tiandy Easy7 7.17.0 installations. The 'week' parameter must be passed to the endpoint and is processed by backend OS command execution. No authentication credentials are required. The attack does not depend on user interaction or non-default configuration settings; if Easy7 is running and accessible on the network, the endpoint can be reached and exploited. Exploitation is limited only by the OS-level privilege context of the Easy7 process itself and any network-level access controls (firewall, network segmentation) that may isolate the service.

CVSS 5.5 with network vector (AV:N), low complexity (AC:L), and no authentication required (PR:N) indicates a straightforward remote attack surface. However, the CVSS4.0 vector shows limited impact (VC:L/VI:L/VA:L) with no scope expansion, suggesting the command execution runs under a restricted context rather than with administrative privilege. The presence of publicly available exploit code ('E:P' in vector) elevates real-world risk despite the moderate CVSS score - this is not a theoretical vulnerability. No KEV status provided, but public POC availability combined with vendor non-responsiveness and remote unauthenticated access creates a credible exploitation risk. The limited confidentiality/integrity/availability impact suggests the service runs with reduced privileges, which is a positive defense-in-depth measure but does not eliminate risk. Organizations running unpatched 7.17.0 instances face exploitable systems accessible from the network.

An attacker identifies a vulnerable Tiandy Easy7 instance exposed on the network and sends a crafted HTTP request to /Easy7/rest/systemInfo/updateDbBackupInfo with a malicious 'week' parameter containing shell commands (e.g., week=1;id;). The application directly executes the injected OS command with the privileges of the Easy7 service process, allowing the attacker to enumerate system information, create reverse shells, or escalate privileges for further compromise.