The vulnerability CVE-2026-9466 affects Tiandy Easy7 Integrated Management Platform 7.17.0. It arises from improper handling of requests to the API endpoint /rest/user/updateUserPassword, which is used for password recovery. An attacker can remotely exploit this weakness without any privileges or user interaction to perform a weak password recovery attack. The issue was publicly disclosed with no vendor response or patch available as of the publication date. The CVSS 4.0 base score is 6.9, indicating medium severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation allows an unauthenticated remote attacker to manipulate the password recovery process, potentially resetting user passwords without authorization. This could lead to unauthorized access to user accounts within the affected platform. The vulnerability does not require privileges or user interaction, increasing the risk of exploitation. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, organizations should monitor for vendor updates. In the meantime, consider restricting access to the affected API endpoint via network controls or web application firewalls to limit exposure. Avoid exposing the management platform directly to untrusted networks until a patch is available.