CVE-2026-4585 | Tiandy Easy7 Integrated Management Platform up to 7.17.0 Configuration ImportSystemConfiguration.jsp File os command injection

A vulnerability classified as critical has been found in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This vulnerability affects unknown code of the file /Easy7/apps/WebService/ImportSystemConfiguration.jsp of the component Configuration Handler. The manipulation of the argument File leads to os command injection.

This vulnerability is documented as CVE-2026-4585. The attack can be initiated remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.