PT-2026-27111 · Tiandy · Easy7 Integrated Management Platform

Red88-Debug + 1 · Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-4585

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tiandy Easy7 Integrated Management Platform versions up to 7.17.0

Description A flaw exists in the Configuration Handler component of Tiandy Easy7 Integrated Management Platform. Specifically, the issue resides in the /Easy7/apps/WebService/ImportSystemConfiguration.jsp file. Manipulation of the File argument can result in operating system command injection. This allows for remote attacks. The exploit for this issue has been publicly disclosed.

Recommendations Versions prior to 7.17.0 should be used.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2026-4585

Affected Products

Easy7 Integrated Management Platform

References · 8

• 🔥 https://my.feishu.cn/docx/WkHjd3oajoIw5exHk9ecUHaFnKd?from=from_copylink · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4585 · Security Note
• https://twitter.com/0dayPublishing/status/2036045090703958397 · Twitter Post
• https://vuldb.com/?ctiid.352422 · Note
• https://vuldb.com/?id.352422 · Note
• https://twitter.com/OrizonCyber/status/2036133417444581574 · Twitter Post
• https://twitter.com/vuldb/status/2036000050875400622 · Twitter Post
• https://vuldb.com/?submit.775457 · Note