OS Command Injection Vulnerability in Tiandy Easy7 Integrated Management Platform
CVE-2026-7698

6.9MEDIUM

Key Information:

Vendor: Tiandy
Status: Easy7 Integrated Management Platform
Vendor: CVE Published:; 3 May 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-7698?

A critical vulnerability has been detected within the Tiandy Easy7 Integrated Management Platform version 7.17.0. This vulnerability arises from an inappropriate handling of the argument 'week' in the file /Easy7/rest/systemInfo/updateDbBackupInfo, which could potentially allow an attacker to execute arbitrary operating system commands. The exploit is executable remotely, raising significant concerns for users of the platform. Despite early disclosure to the vendor, there has been no response regarding mitigation or patching efforts, leaving the affected systems at risk of exploitation.

Affected Version(s)

Easy7 Integrated Management Platform 7.17.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-7698 - Proof of Concept