Vulnerability · Published May 25, 2026 · Assigned by VulDB

CVE-2026-9466Tiandy Easy7 Integrated Management Platform API Endpoint updateUserPassword password recovery

Medium 5.3

In plain English

A medium-severity security flaw in Easy7 Integrated Management Platform from Tiandy. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 71.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in Tiandy Easy7 Integrated Management Platform 7.17.0. This issue affects some unknown processing of the file /rest/user/updateUserPassword of the component API Endpoint. Executing a manipulation can lead to weak password recovery. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Tiandy	Easy7 Integrated Management Platform	7.17.0

Weakness: CWE-640 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-365447 | Tiandy Easy7 Integrated Management Platform API Endpoint updateUserPassword password recovery vdb-entry
VDB-365447 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #813990 | Tiandy Technologies Co., Ltd. Easy7 Integrated Management Platform 7.17.0 Weak Password Recovery third-party-advisory
https://ucn9h68n9289.feishu.cn/wiki/DRghw6X8piOtClkjBkHcfgvtnPx?from=from_copylink exploit