| शीर्षक | Tiandy Technologies Co., Ltd. Easy7 Integrated Management Platform 7.17.0 Missing Authentication |
|---|
| विवरण | A critical authentication bypass vulnerability exists in the Eas7 Integrated Management Platform. An unauthenticated remote attacker can obtain a valid device identifier (Id) by accessing the UpdateLocalDevInfo.jsp endpoint. By leveraging this Id, the attacker can subsequently invoke the GetCmsDbInfo.jsp interface to retrieve sensitive database configuration details, including the connection string, plaintext username, and password. This vulnerability grants full access to the underlying database, allowing for unauthorized data exfiltration, modification, or destruction, and potentially leading to full system compromise. |
|---|
| स्रोत | ⚠️ https://my.feishu.cn/docx/Vc4QdU5KNoMF57xxubOcBwPSnqf?from=from_copylink |
|---|
| उपयोगकर्ता | 0menc (UID 75423) |
|---|
| सबमिशन | 02/03/2026 11:25 AM (7 महीनों पहले) |
|---|
| संयम | 14/03/2026 11:25 PM (13 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 351093 [Tiandy Easy7 Integrated Management Platform 7.17.0 Device Identifier UpdateLocalDevInfo.jsp username/password कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|