PT-2026-27111 · Tiandy · Easy7 Integrated Management Platform

Red88-Debug + 1 · Publicado 2026-03-23 · Atualizado 2026-03-23 · CVE-2026-4585

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tiandy Easy7 Integrated Management Platform versions up to 7.17.0

Description A flaw exists in the Configuration Handler component of Tiandy Easy7 Integrated Management Platform. Specifically, the issue resides in the /Easy7/apps/WebService/ImportSystemConfiguration.jsp file. Manipulation of the File argument can result in operating system command injection. This allows for remote attacks. The exploit for this issue has been publicly disclosed.

Recommendations Versions prior to 7.17.0 should be used.

Exploit

Correção

Command Injection

OS Command Injection

Enumeração de Fraquezas

CWE-77

CWE-78

Identificadores relacionados

CVE-2026-4585

Produtos afetados

Easy7 Integrated Management Platform

Referências · 8

• 🔥 https://my.feishu.cn/docx/WkHjd3oajoIw5exHk9ecUHaFnKd?from=from_copylink · Exploit
• https://twitter.com/0dayPublishing/status/2036045090703958397 · Publicação no Twitter
• https://vuldb.com/?ctiid.352422 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-4585 · Nota de Segurança
• https://vuldb.com/?id.352422 · Nota
• https://twitter.com/OrizonCyber/status/2036133417444581574 · Publicação no Twitter
• https://twitter.com/vuldb/status/2036000050875400622 · Publicação no Twitter
• https://vuldb.com/?submit.775457 · Nota