CVE-2026-97866
mediumA weakness has been identified in Zhonglun CloudPOS 3.0.
A weakness has been identified in Zhonglun CloudPOS 3.0. Affected by this vulnerability is an unknown functionality of the file Program.cs of the component Automatic Update. Executing a manipulation of the argument version/url/packagekey/package name can lead to channel accessible by non-endpoint. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitation appears to be difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/user-attachments/files/30572292/CloudPos.docx cna@vuldb.com
- https://github.com/xy-f0/CVE/issues/4 cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-97866 cna@vuldb.com
- https://vuldb.com/submit/911606 cna@vuldb.com
- https://vuldb.com/vuln/409883 cna@vuldb.com
- https://vuldb.com/vuln/409883/cti cna@vuldb.com