Cyber Resilience

CVE-2026-4287

Medium

Published: 17 March 2026

Published
17 March 2026
Modified
22 April 2026
KEV Added
Patch
CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0004 13.1th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-4287 is a medium-severity Injection (CWE-74) vulnerability in Feishu (inferred from references). Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-4287 is a SQL injection vulnerability (CWE-74, CWE-89) affecting Tiandy Easy7 Integrated Management Platform version 7.17.0. The issue occurs in an unknown function of the /rest/devStatus/queryResources file within the Endpoint component, where manipulation of the areaId argument triggers the injection.

The vulnerability enables remote exploitation by unauthenticated attackers over the network, with low attack complexity and no requirement for user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base score 7.3). Successful attacks can result in limited impacts to confidentiality, integrity, and availability.

Advisories from VulDB indicate that an exploit has been publicly released and may be used for attacks. The vendor was contacted early regarding disclosure but provided no response, and no patches or mitigations are mentioned in available references.

EU & UK References

Vulnerability details

A security flaw has been discovered in Tiandy Easy7 Integrated Management Platform 7.17.0. The affected element is an unknown function of the file /rest/devStatus/queryResources of the component Endpoint. Performing a manipulation of the argument areaId results in sql injection. The…

more

attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

SQL injection in a remotely accessible web endpoint (/rest/devStatus/queryResources) of a public-facing management platform directly enables unauthenticated remote exploitation with no user interaction required, mapping to initial access via public-facing application exploitation. No other techniques are directly facilitated given the limited C/I/A impacts and lack of RCE or specific post-exploitation primitives described.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-3150Shared CWE-74, CWE-89
CVE-2026-3746Shared CWE-74, CWE-89
CVE-2025-2683Shared CWE-74, CWE-89
CVE-2026-5238Shared CWE-74, CWE-89
CVE-2026-4288Shared CWE-74, CWE-89
CVE-2026-2220Shared CWE-74, CWE-89
CVE-2025-1535Shared CWE-74, CWE-89
CVE-2026-0597Shared CWE-74, CWE-89
CVE-2026-1688Shared CWE-74, CWE-89
CVE-2026-5018Shared CWE-74, CWE-89

Affected Assets

Feishu
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly prevents SQL injection attacks by requiring validation and sanitization of inputs like the areaId parameter in the /rest/devStatus/queryResources endpoint.

prevent

Ensures timely identification, reporting, and correction of the specific SQL injection flaw in Tiandy Easy7 version 7.17.0.

preventdetect

Enables detection of the SQL injection vulnerability through scanning and subsequent remediation to address the publicly disclosed exploit.

References