CVE-2026-2985

MEDIUM 6.3

Tiandy Video Surveillance System 视频监控平台 CLSBODownLoad.java downloadImage server-side request forgery

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A security flaw has been discovered in Tiandy Video Surveillance System 视频监控平台 7.17.0. This impacts the function downloadImage of the file /com/tiandy/easy7/core/bo/CLSBODownLoad.java. Performing a manipulation of the argument urlPath results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-918
Vendor	tiandy
Product	video surveillance system 视频监控平台
Published	Feb 23, 2026
Last Updated	Feb 23, 2026

Stay Ahead of the Next One

Get instant alerts for tiandy video surveillance system 视频监控平台

Be the first to know when new medium vulnerabilities affecting tiandy video surveillance system 视频监控平台 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Tiandy / Video Surveillance System 视频监控平台

7.17.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/?id.347368 vuldb.com: https://vuldb.com/?ctiid.347368 vuldb.com: https://vuldb.com/?submit.756137 my.feishu.cn: https://my.feishu.cn/wiki/C1TIwBoJziINWlkGt8ucnZJPnEb?from=from_copylink

Credits

🔍 red88-debug (VulDB User)