CVE-2026-4585
OS Command Injection in Tiandy Easy7 Configuration Handler (Remote
Publication date: 2026-03-23
Last updated on: 2026-03-23
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tiandy | easy7_integrated_management_platform | to 7.17.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Tiandy Easy7 Integrated Management Platform up to version 7.17.0, specifically in the Configuration Handler component within the file /Easy7/apps/WebService/ImportSystemConfiguration.jsp.
The issue arises from the manipulation of the 'File' argument, which leads to an operating system command injection vulnerability. This means an attacker can remotely execute arbitrary OS commands on the affected system by exploiting this flaw.
The vulnerability has been publicly disclosed and the vendor did not respond to early contact attempts regarding this issue.
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute arbitrary operating system commands on the affected system without any authentication or user interaction.
Such unauthorized command execution can lead to full system compromise, including data theft, system disruption, installation of malware, or further attacks within the network.
Given the high CVSS scores (up to 10.0 in version 2.0), the impact is severe, potentially affecting confidentiality, integrity, and availability of the system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know