This vulnerability affects the Tiandy Easy7 Integrated Management Platform 7.17.0 specifically in the API endpoint /rest/user/updateUserPassword. An attacker can remotely manipulate this endpoint to cause weak password recovery, which may allow unauthorized password resets or bypass of intended security controls. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, no privileges or user interaction required, and low impact on confidentiality but some impact on integrity. The vendor has not provided a fix or advisory, and no patch links are available. The vulnerability is publicly disclosed but not yet known to be exploited in the wild.

Successful exploitation could allow an unauthenticated remote attacker to manipulate the password recovery process, potentially resetting user passwords insecurely. This could lead to unauthorized access to user accounts within the Easy7 Integrated Management Platform. The impact on confidentiality is minimal, but integrity is affected due to unauthorized password changes. Availability is not impacted. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for vendor updates. Until a patch is released, consider restricting access to the affected API endpoint if possible, or implement compensating controls such as network-level restrictions or additional authentication layers around password recovery functions.