OS Command Injection in Tiandy Easy7 Management Platform

A vulnerability was identified in Tiandy Easy7 Integrated Management Platform 7.17.0. Affected by this vulnerability is an unknown functionality of the file /Easy7/rest/systemInfo/updateDbBackupInfo. Such manipulation of the argument week leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Casky was already ahead

This CVE exploits attack patterns that Casky's 419matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Tiandy Easy7 Integrated Management Platform version 7.17.0 contains a critical os command injection vulnerability in the /Easy7/rest/systemInfo/updateDbBackupInfo endpoint. By manipulating the 'week' parameter, unauthenticated attackers can inject arbitrary operating system commands that execute with the privileges of the application. This vulnerability matters because Tiandy's Easy7 platform is widely deployed in security and surveillance infrastructure globally, making it an attractive target for initial access and lateral movement. Organizations running affected versions face immediate risk of complete system compromise, data exfiltration, and persistent backdoor installation. The vendor's non-responsiveness to early disclosure compounds the risk exposure.

Casky's 419 mapped security skills leverage Claude's extended reasoning to detect the behavioral patterns associated with this attack chain across MITRE ATT&CK's Initial Access (TA0001), Execution (TA0002), and Command and Control (TA0043) techniques. Practitioners using Casky would identify suspicious HTTP requests to the vulnerable endpoint containing shell metacharacters or command chaining syntax in the 'week' parameter, detect anomalous child process spawning from the application runtime, monitor for unexpected outbound network connections during request processing, and flag POST requests lacking proper input validation. The platform's skill coverage would correlate these signals—request manipulation, process execution anomalies, and lateral movement indicators—enabling practitioners to distinguish between legitimate API calls and exploitation attempts before attackers establish persistent access.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

419 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-7698.

analyzing-android-malware-with-apktool

malware analysis · medium

Run

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-bootkit-and-rootkit-samples

malware analysis · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-7698

Casky has 419 skills that investigate the attack patterns behind CVE-2026-7698. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn