Tiandy Technologies — 2 prefixes (MA-L)

Tiandy holds two MA-L blocks — 3C:DA:6D and E4:E6:6C — both registered to "Tiandy Technologies Co.,LTD" (the two registry rows differ only in the capitalization of "CO."/"Co."; they map to the same vendor). Both carry the identical registered address: No.8, Haitai Huake Rd 2 (outside ring road), Huayuan New Technology Industrial Park, Tianjin, China 300384. Tiandy is a large Chinese video-surveillance manufacturer, founded 1994 and frequently ranked among the top-10 globally behind Hikvision and Dahua; these OUIs appear on IP/network cameras, NVRs, and its Easy7 video-management platform. Two categories of context are material and confirmed. Regulatory: Tiandy was added to the US Commerce Entity List effective 16 December 2022 over implication in human-rights abuses against Uyghurs and other Muslim minorities in Xinjiang and for facilitating Iran's IRGC acquisition of US-origin technology (Intel publicly stated it stopped doing business with Tiandy afterward). Security: Tiandy's Easy7 platform and video-surveillance REST API have multiple recent, remotely-exploitable RCE vulnerabilities — CVE-2026-4585 (OS command injection, CVSS 9.8), CVE-2026-4221 and CVE-2026-3797 (file-upload RCE), plus SQLi and SSRF flaws — atop a documented pattern of unresponsive disclosure handling dating to 2017. For triage, a Tiandy OUI flags Entity-Listed surveillance hardware with a known-vulnerable management stack; treat its appearance on a corporate network as a compliance and shadow-IT signal.

IEEE assignment

2 prefixes → Tiandy Technologies Co.,LTD (two registry rows, "CO."/"Co." capitalization differs); registered Tianjin, China [Confirmed] — the IEEE MA-L registry, maclookup.app

Registry / block size

MA-L (24-bit OUI); 2 blocks (3C:DA:6D, E4:E6:6C; ~33.6M addresses total) [Confirmed] — the IEEE MA-L registry, https://maclookup.app/vendors/tiandy-technologies-co-ltd. NOTE: IEEE's public OUI data publishes NO assignment/registration date (the IEEE MA-L registry columns are only Registry, Assignment, Organization Name, Organization Address); maclookup.app shows "12 November 2019" (3C:DA:6D) and "07 November 2023" (E4:E6:6C) but these are third-party database artifacts, not IEEE facts — do not attribute to IEEE.

HQ / country

No.8, Haitai Huake Rd 2 (outside ring road), Huayuan New Technology Industrial Park, Tianjin 300384, China [Confirmed] — the IEEE MA-L registry

Company status

active; large Chinese video-surveillance manufacturer, founded 1994, commonly cited as top-10 globally behind Hikvision/Dahua [Confirmed] — https://en.tiandy.com/

Device types

IP/network cameras, NVRs, Easy7 video-management platform, access control [Confirmed] — https://en.tiandy.com/network-camera/, https://maclookup.app/vendors/tiandy-technologies-co-ltd

Notable products

Tiandy-branded IP cameras (AK/SK/LK series), NVRs, Easy7 Integrated Management Platform

Verified prefix sample

3C:DA:6D, E4:E6:6C [Confirmed] — https://maclookup.app/macaddress/3cda6d, https://maclookup.app/macaddress/e4e66c

Special note

Two registrant strings differing only in "CO."/"Co." capitalization; both share the identical Tianjin address and map to one vendor. [Confirmed] — the IEEE MA-L registry

Regulatory

added to US Commerce Dept. Entity List eff. 2022-12-16 for human-rights abuses re: Uyghurs/Muslim minorities in Xinjiang and for facilitating Iranian IRGC acquisition of US-origin tech; Intel publicly cut ties (factual, not advocacy)

[Confirmed] — https://www.nbcnews.com/politics/national-security/us-sanctions-tiandy-surveillance-tech-china-iran-uyghurs-rcna61896

Security context

Easy7 platform / video-surveillance REST API has multiple recent RCE CVEs — CVE-2026-4585 (OS command injection, CVSS 9.8), CVE-2026-4221 & CVE-2026-3797 (file-upload RCE), CVE-2026-3818 (SQLi), CVE-2026-2985 (SSRF); historical unresponsive-disclosure pattern back to CVE-2017-15236 [Confirmed] — https://www.cvedetails.com/vendor/17094/Tiandy.html, https://www.sentinelone.com/vulnerability-database/cve-2026-4585/, https://www.exploit-db.com/exploits/44058

Related vendors

peer Chinese surveillance vendors Hikvision, Dahua (cross-reference for Entity-List/compliance context)

Analyst note

A Tiandy OUI flags Entity-Listed surveillance hardware with a known-vulnerable management stack; treat appearance on a corporate network as a compliance and shadow-IT signal.