A remote OS command injection vulnerability exists in Tiandy Easy7 Integrated Management Platform version 7.17.0. The flaw is in the /Easy7/rest/systemInfo/updateDbBackupInfo endpoint, where manipulation of the 'week' argument allows execution of arbitrary OS commands. Public exploit code is available. The vendor has not responded to disclosure requests, and no patch information is provided.