PT-2026-25831 · Tiandy · Easy7 Integrated Management Platform

0Menc + 1 · Published 2026-03-16 · Updated 2026-03-17 · CVE-2026-4287

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Tiandy Easy7 Integrated Management Platform version 7.17.0

Description A security flaw exists in Tiandy Easy7 Integrated Management Platform version 7.17.0. The issue is a SQL injection affecting an unknown function within the Endpoint component, specifically through the /rest/devStatus/queryResources API endpoint. Manipulation of the areaId parameter can trigger the SQL injection. This attack can be initiated remotely. The exploit has been publicly released. The vendor was contacted regarding this disclosure but did not respond.

Recommendations Tiandy Easy7 Integrated Management Platform version 7.17.0: As a temporary workaround, consider restricting access to the /rest/devStatus/queryResources API endpoint to minimize the risk of exploitation.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-4287

Affected Products

Easy7 Integrated Management Platform

References · 11

• 🔥 https://my.feishu.cn/docx/F68OduQq8oI2MdxmjHlch8u5n8f?from=from_copylink · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4287 · Security Note
• https://vuldb.com/?ctiid.351292 · Note
• https://vuldb.com/?id.351292 · Note
• https://twitter.com/RedPacketSec/status/2033922006555525450 · Twitter Post
• https://vuldb.com/?submit.771956 · Note
• https://t.me/cveNotify/155575 · Telegram Post
• https://twitter.com/cyberbivash/status/2033724855086878727 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2033717759389958259 · Twitter Post
• https://twitter.com/CVEarity/status/2033799991144419756 · Twitter Post
• https://twitter.com/CVEnew/status/2033755311488512502 · Twitter Post