CVE-2026-9466
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Tiandy Easy7 Integrated Management Platform version 7.17.0 has a vulnerability in the /rest/user/updateUserPassword API endpoint. Manipulation can lead to weak password recovery. The attack can be executed remotely, and the exploit has been publicly disclosed.
Risk Assessment
Risk of unauthorized password change, potentially leading to account takeover and access to platform management.
Recommendation
Contact Tiandy for an update. Temporarily restrict access to the /rest/user/updateUserPassword endpoint to trusted IP addresses only.
Other vulnerabilities in Tiandy Easy7 Integrated Management Platform
See all- CVE-2026-7698High
A vulnerability was identified in Tiandy Easy7 Integrated Management Platform version 7.17.0, affecting an unknown functionality of the file /Easy7/rest/systemInfo/updateDbBackupInfo. Manipulation of the argument week leads to OS command injection.
- CVE-2026-9465High
SQL Injection vulnerability in /Easy7/apps/WebService/GetDBDataEx.jsp of Tiandy Easy7 Integrated Management Platform 7.17.0. Manipulation of strTBName argument leads to SQL injection. Remote attack, exploit public. Vendor did not respond.
Original NVD description (English source)
A vulnerability was determined in Tiandy Easy7 Integrated Management Platform 7.17.0. This issue affects some unknown processing of the file /rest/user/updateUserPassword of the component API Endpoint. Executing a manipulation can lead to weak password recovery. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.