CVE-2026-3797: Tiandy Video Surveillance System RCE Flaw

CVE-2026-3797 Overview

A security vulnerability has been identified in Tiandy Video Surveillance System (视频监控平台) version 7.17.0. The vulnerability exists within the uploadFile function located in the file /src/com/tiandy/easy7/core/rest/CLS_REST_File.java. Improper handling of the fileName argument allows attackers to perform unrestricted file uploads, potentially leading to arbitrary code execution on the affected system.

Critical Impact

This unrestricted file upload vulnerability enables remote attackers with low-level access to upload malicious files to the surveillance system, potentially compromising the entire video monitoring infrastructure and enabling further network intrusion.

Affected Products

• Tiandy Video Surveillance System Firmware 7.17.0
• Tiandy Video Surveillance System Hardware

Discovery Timeline

• 2026-03-09 - CVE-2026-3797 published to NVD
• 2026-03-10 - Last updated in NVD database

Technical Details for CVE-2026-3797

Vulnerability Analysis

This vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-284 (Improper Access Control). The flaw resides in the file upload functionality of the Tiandy Video Surveillance System's REST API implementation. The uploadFile function in CLS_REST_File.java fails to properly validate or sanitize the fileName parameter before processing uploaded files.

The vulnerability allows authenticated attackers with low privileges to upload arbitrary files to the server. Without proper file type validation, extension filtering, or content verification, attackers can upload executable files, web shells, or other malicious content that could be subsequently executed on the target system.

Root Cause

The root cause of this vulnerability is insufficient input validation in the file upload handler. The uploadFile function does not implement adequate security controls to restrict the types of files that can be uploaded. This includes missing validation for:

• File extension whitelisting or blacklisting
• MIME type verification
• File content inspection
• Filename sanitization to prevent path traversal

The vendor was contacted regarding this disclosure but did not respond, leaving users without official guidance or patches.

Attack Vector

The attack can be initiated remotely over the network. An attacker with valid credentials (low privilege level required) can exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable endpoint. The attack flow typically involves:

1. Authenticating to the Tiandy Video Surveillance System with minimal privileges
2. Crafting a malicious file with an executable payload (e.g., JSP web shell)
3. Submitting the file through the vulnerable uploadFile endpoint with a manipulated fileName parameter
4. Accessing the uploaded file to trigger code execution

The vulnerability has been publicly disclosed and technical details are available through the VulDB disclosure, increasing the risk of exploitation in the wild.

Detection Methods for CVE-2026-3797

Indicators of Compromise

• Unexpected files appearing in upload directories, particularly files with executable extensions (.jsp, .jspx, .war, .jar)
• HTTP POST requests to /rest/file/upload or similar endpoints containing unusual fileName parameters
• Web shell artifacts or backdoor files in web-accessible directories
• Anomalous outbound network connections from the surveillance system server

Detection Strategies

• Monitor HTTP traffic to the Tiandy surveillance system for file upload requests with suspicious file extensions or content types
• Implement file integrity monitoring on directories where uploaded files are stored
• Review web server access logs for requests to unexpected files in upload directories
• Deploy network-based intrusion detection rules to identify web shell communication patterns

Monitoring Recommendations

• Enable verbose logging on the Tiandy Video Surveillance System to capture all file upload activities
• Configure SIEM rules to alert on file uploads with executable extensions to the surveillance platform
• Implement egress filtering and monitor for unusual outbound connections from surveillance system servers
• Regularly audit user accounts and access levels to identify potential insider threats or compromised credentials

How to Mitigate CVE-2026-3797

Immediate Actions Required

• Restrict network access to the Tiandy Video Surveillance System to trusted IP addresses only using firewall rules
• Implement a web application firewall (WAF) to filter malicious file upload attempts
• Review and remove any suspicious files from upload directories on affected systems
• Audit user accounts and disable any unnecessary accounts with upload privileges
• Consider taking the system offline if it contains critical infrastructure until mitigations are in place

Patch Information

No official patch is currently available from Tiandy. The vendor was contacted about this vulnerability but did not respond. Users should monitor the VulDB entry and vendor channels for future security updates.

Workarounds

• Implement strict network segmentation to isolate the surveillance system from critical network segments
• Deploy a reverse proxy or WAF in front of the application to enforce file upload restrictions at the network level
• Configure server-level restrictions to prevent execution of uploaded files in upload directories
• Implement additional authentication requirements (e.g., MFA) for accessing the surveillance system
• Consider using application-layer controls to whitelist only specific file types (e.g., image formats) for upload

# Example: Network isolation using iptables
# Restrict access to surveillance system to specific management subnet
iptables -A INPUT -p tcp --dport 80 -s 192.168.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP