CVE-2026-3797
Published: 09 March 2026
Summary
CVE-2026-3797 is a medium-severity Improper Access Control (CWE-284) vulnerability in Tiandy Video Surveillance System Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-3797 is an unrestricted file upload vulnerability affecting Tiandy Video Surveillance System (视频监控平台) version 7.17.0. The flaw exists in the uploadFile function within the file /src/com/tiandy/easy7/core/rest/CLS_REST_File.java, where manipulation of the fileName argument enables unrestricted file uploads. It is associated with CWEs-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type), carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), and was published on 2026-03-09.
An attacker with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling malicious file uploads that could lead to further compromise depending on the uploaded content.
Advisories and additional details are documented in references such as VulDB entries (https://vuldb.com/?ctiid.349764, https://vuldb.com/?id.349764, https://vuldb.com/?submit.766386) and a Feishu document (https://my.feishu.cn/docx/P3Bgdl9BHocn66xCMpCcgCD7nhe?from=from_copylink). The vendor was contacted early regarding disclosure but provided no response, and no patches or mitigations are mentioned.
The exploit has been publicly disclosed and may be used by attackers.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10289
Vulnerability details
A security vulnerability has been detected in Tiandy Video Surveillance System 视频监控平台 7.17.0. The impacted element is the function uploadFile of the file /src/com/tiandy/easy7/core/rest/CLS_REST_File.java. The manipulation of the argument fileName leads to unrestricted upload. The attack may be initiated remotely.…
more
The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload in public-facing web app directly enables remote exploitation of the application (T1190) and deployment of web shells via malicious uploaded files (T1100).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations on the uploadFile function so that only permitted file types/names can be written, directly blocking the CWE-284 improper access control flaw.
Requires validation of the fileName argument and file content before acceptance, directly mitigating the CWE-434 unrestricted upload vulnerability.
Performs integrity checks and malicious-code scanning on uploaded files, limiting the impact of any file that bypasses input validation.