A vulnerability classified as critical has been found in Tiandy Video Surveillance System 视频监控平台 7.17.0. This impacts the function
downloadImage of the file /com/tiandy/easy7/core/bo/CLSBODownLoad.java. Performing a manipulation of the argument urlPath results in server-side request forgery.
This vulnerability is reported as CVE-2026-2985. The attack is possible to be carried out remotely. Moreover, an exploit is present.
The vendor was contacted early about this disclosure but did not respond in any way.
