Weak Password Recovery Vulnerability in Tiandy Easy7 Integrated Management Platform
CVE-2026-9466

6.9MEDIUM

Key Information:

Vendor: Tiandy
Status: Easy7 Integrated Management Platform
Vendor: CVE Published:; 25 May 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-9466?

A vulnerability has been discovered in the Tiandy Easy7 Integrated Management Platform version 7.17.0, affecting the API Endpoint used for updating user passwords. This issue stems from insecure handling of the password recovery mechanism located at /rest/user/updateUserPassword, allowing remote attackers to exploit the system. The exploit could potentially enable unauthorized password resets, compromising user accounts. Despite early notification, the vendor has not responded to address this security flaw, making users vulnerable to remote attacks that could exploit the weak password recovery process.

Affected Version(s)

Easy7 Integrated Management Platform 7.17.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-9466 - Proof of Concept