CVE-2026-7698
HighSummary
A vulnerability was identified in Tiandy Easy7 Integrated Management Platform version 7.17.0, affecting an unknown functionality of the file /Easy7/rest/systemInfo/updateDbBackupInfo. Manipulation of the argument week leads to OS command injection.
Risk Assessment
An attacker can remotely exploit this vulnerability, posing a serious security threat to the system. A publicly available exploit may be used to carry out an attack.
Recommendation
It is recommended to immediately update the platform to the latest version to eliminate this vulnerability. Additionally, monitor systems for unauthorized activities.
Other vulnerabilities in Tiandy Easy7 Integrated Management Platform 7.17.0
See all- CVE-2026-9466Medium
Tiandy Easy7 Integrated Management Platform version 7.17.0 has a vulnerability in the /rest/user/updateUserPassword API endpoint. Manipulation can lead to weak password recovery. The attack can be executed remotely, and the exploit has been publicly disclosed.
- CVE-2026-9465High
SQL Injection vulnerability in /Easy7/apps/WebService/GetDBDataEx.jsp of Tiandy Easy7 Integrated Management Platform 7.17.0. Manipulation of strTBName argument leads to SQL injection. Remote attack, exploit public. Vendor did not respond.
Original NVD description (English source)
A vulnerability was identified in Tiandy Easy7 Integrated Management Platform 7.17.0. Affected by this vulnerability is an unknown functionality of the file /Easy7/rest/systemInfo/updateDbBackupInfo. Such manipulation of the argument week leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.