CVE-2026-2985

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2985", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-22T16:48:08.502Z", "datePublished": "2026-02-23T10:32:49.611Z", "dateUpdated": "2026-02-23T12:37:00.359Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T10:32:49.611Z"}, "title": "Tiandy Video Surveillance System \u89c6\u9891\u76d1\u63a7\u5e73\u53f0 CLSBODownLoad.java downloadImage server-side request forgery", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-918", "lang": "en", "description": "Server-Side Request Forgery"}]}], "affected": [{"vendor": "Tiandy", "product": "Video Surveillance System \u89c6\u9891\u76d1\u63a7\u5e73\u53f0", "versions": [{"version": "7.17.0", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Tiandy Video Surveillance System \u89c6\u9891\u76d1\u63a7\u5e73\u53f0 7.17.0. This impacts the function downloadImage of the file /com/tiandy/easy7/core/bo/CLSBODownLoad.java. Performing a manipulation of the argument urlPath results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-02-22T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-22T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-22T17:53:27.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "red88-debug (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.347368", "name": "VDB-347368 | Tiandy Video Surveillance System \u89c6\u9891\u76d1\u63a7\u5e73\u53f0 CLSBODownLoad.java downloadImage server-side request forgery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347368", "name": "VDB-347368 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.756137", "name": "Submit #756137 | Tiandy Tiandy video surveillance system 7.17.0 Server-Side Request Forgery", "tags": ["third-party-advisory"]}, {"url": "https://my.feishu.cn/wiki/C1TIwBoJziINWlkGt8ucnZJPnEb?from=from_copylink", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-23T12:36:27.606858Z", "id": "CVE-2026-2985", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T12:37:00.359Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2985", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-23T12:36:27.606858Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T12:36:46.333Z"}}], "cna": {"title": "Tiandy Video Surveillance System \u89c6\u9891\u76d1\u63a7\u5e73\u53f0 CLSBODownLoad.java downloadImage server-side request forgery", "credits": [{"lang": "en", "type": "reporter", "value": "red88-debug (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "Tiandy", "product": "Video Surveillance System \u89c6\u9891\u76d1\u63a7\u5e73\u53f0", "versions": [{"status": "affected", "version": "7.17.0"}]}], "timeline": [{"lang": "en", "time": "2026-02-22T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-22T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-22T17:53:27.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.347368", "name": "VDB-347368 | Tiandy Video Surveillance System \u89c6\u9891\u76d1\u63a7\u5e73\u53f0 CLSBODownLoad.java downloadImage server-side request forgery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347368", "name": "VDB-347368 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.756137", "name": "Submit #756137 | Tiandy Tiandy video surveillance system 7.17.0 Server-Side Request Forgery", "tags": ["third-party-advisory"]}, {"url": "https://my.feishu.cn/wiki/C1TIwBoJziINWlkGt8ucnZJPnEb?from=from_copylink", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Tiandy Video Surveillance System \u89c6\u9891\u76d1\u63a7\u5e73\u53f0 7.17.0. This impacts the function downloadImage of the file /com/tiandy/easy7/core/bo/CLSBODownLoad.java. Performing a manipulation of the argument urlPath results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "Server-Side Request Forgery"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T10:32:49.611Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2985", "state": "PUBLISHED", "dateUpdated": "2026-02-23T12:37:00.359Z", "dateReserved": "2026-02-22T16:48:08.502Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-23T10:32:49.611Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Video Surveillance System \u89c6\u9891\u76d1\u63a7\u5e73\u53f0", "vendor": "Tiandy", "versions": [{"status": "affected", "version": "7.17.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Tiandy Video Surveillance System \u89c6\u9891\u76d1\u63a7\u5e73\u53f0 7.17.0. This impacts the function downloadImage of the file /com/tiandy/easy7/core/bo/CLSBODownLoad.java. Performing a manipulation of the argument urlPath results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se ha descubierto una vulnerabilidad de seguridad en el Sistema de Videovigilancia Tiandy ?????? 7.17.0. Esta afecta a la funci\u00f3n downloadImage del archivo /com/tiandy/easy7/core/bo/CLSBODownLoad.java. Si se manipula el argumento urlPath se provoca una falsificaci\u00f3n de petici\u00f3n del lado del servidor. Puede lanzarse el ataque en remoto. Se ha publicado el exploit y puede ser utilizado para ataques. Antes de la divulgar esta vulnerabilidad se contact\u00f3 con el proveedor, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-2985", "lastModified": "2026-06-17T10:32:26.877", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2985", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-23T12:36:27.606858Z", "version": "2.0.3"}}]}, "published": "2026-02-23T11:16:39.770", "references": [{"source": "cna@vuldb.com", "url": "https://my.feishu.cn/wiki/C1TIwBoJziINWlkGt8ucnZJPnEb?from=from_copylink"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.347368"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.347368"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.756137"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.17.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Video Surveillance System \u89c6\u9891\u76d1\u63a7\u5e73\u53f0", "source": "cna", "vendor": "Tiandy"}, "product": "video_surveillance_system", "vendor": "tiandy"}], "analysis": {"en": {"generated_at": "2026-04-17T16:18:30.464975+00:00", "value": {"mitigation_remediation": ["Verify whether Tiandy has released a patch for version 7.17.0 that addresses the SSRF issue; if available, apply the patch immediately.", "Restrict the downloadImage endpoint so that the urlPath parameter only accepts legitimate internal URLs or relative paths; implement a whitelist or block all others to prevent arbitrary requests.", "Limit the outgoing network connections from the surveillance system to the necessary services; apply firewall or network segmentation to block unexpected outbound traffic that could be triggered by SSRF.", "Enable detailed logging of downloadImage requests and monitor logs for suspicious activity, enabling rapid detection of exploitation attempts."], "summary": {"action": "Assess Impact", "impact": "Server\u2011Side Request Forgery"}, "threat_synthesis": {"affected_systems": "This issue affects Tiandy Video Surveillance System (video monitoring platform) version 7.17.0. No other versions or vendors were listed as affected.", "description_and_impact": "The flaw is a server\u2011side request forgery vulnerability in the downloadImage function of CLSBODownLoad.java in Tiandy Video Surveillance System 7.17.0. An attacker can manipulate the urlPath argument to cause the server to send HTTP requests to arbitrary addresses. This allows external resources to be fetched, potentially exposing internal network information or enabling further malicious activity. The vulnerability is classified as CWE\u2011918 and enables remote exploitation.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate risk. The EPSS score is below 1%, suggesting a low probability of real\u2011world exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack is remotely achievable by sending a crafted request to the downloadImage endpoint, where the attacker supplies a forged urlPath value. Successful exploitation would allow the server to reach arbitrary destinations, possibly exposing internal resources or executing further attack steps."}}}}, "created": "2026-02-23T14:27:52.299459+00:00", "updated": "2026-04-17T16:30:05.823282+00:00", "vendors": ["tiandy", "tiandy$PRODUCT$video_surveillance_system"]}