PT-2026-25620 · Tiandy · Easy7 Integrated Management Platform

0Menc + 1 · Published 2026-03-16 · Updated 2026-03-16 · CVE-2026-4221

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Tiandy Easy7 Integrated Management Platform version 7.17.0

Description A flaw exists within the Tiandy Easy7 Integrated Management Platform that allows for unrestricted file uploads. This issue affects the /rest/file/uploadLedImage endpoint of the Endpoint component. The File parameter can be manipulated to achieve this unrestricted upload, and the attack can be initiated remotely. The exploit for this issue has been publicly released.

Recommendations Tiandy Easy7 Integrated Management Platform version 7.17.0: Address the unrestricted upload issue in the /rest/file/uploadLedImage endpoint by validating the File parameter.

Exploit

Fix

Unrestricted File Upload

Improper Access Control

Weakness Enumeration

CWE-434

CWE-284

Related Identifiers

CVE-2026-4221

Affected Products

Easy7 Integrated Management Platform

References · 8

• 🔥 https://my.feishu.cn/docx/Z5HJdLCxioFs4sxyILbcoSIAnTh?from=from_copylink · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4221 · Security Note
• https://vuldb.com/?id.351145 · Note
• https://twitter.com/CVEnew/status/2033583703092564386 · Twitter Post
• https://t.me/CVEtracker/47535 · Telegram Post
• https://twitter.com/infoflowcloud/status/2033585704555470951 · Twitter Post
• https://vuldb.com/?submit.770534 · Note
• https://vuldb.com/?ctiid.351145 · Note