Home / Vulnerability Intelligence / CVE-2026-4585

CVE-2026-4585 - Vulnerability Analysis

CriticalCVSS: 9.8

Last Updated: March 23, 2026

Tiandy Easy7 Integrated Management Platform - OS Command Injection

Published: March 23, 2026Updated: March 23, 2026Remote Exploitable

Overview

Tiandy Easy7 Integrated Management Platform <= 7.17.0 contains an OS command injection caused by manipulation of the "File" argument in /Easy7/apps/WebService/ImportSystemConfiguration.jsp, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

Severity & Score

Severity: Critical

CVSS Score: 9.8

EPSS Score: 15.3%(Probability of exploitation in next 30 days)

Impact

Remote attackers can execute arbitrary OS commands, potentially leading to full system compromise.

Mitigation

Update to the latest version.

References

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

Mar 23, 2026

🔴 CVE-2026-4585 - Critical (9.8) A vulnerability has been found in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This vulnerability affects unknown code of the file /Easy7/apps/WebService/ImportSystemConfiguration.jsp of the component Configuration Handler. The manipu... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4585/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

Mar 23, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-4585
Severity: Critical
CVSS Score: 9.8
Type: command_injection
Status: unconfirmed
EPSS: 15.3%
Social Posts: 2

CWE

CWE-77

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

15.3%Probability of exploitation in the next 30 days