CVE-2026-111698
CVE-2026-111698 · HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.
CVSS 7.1 · Élevée · EPSS 0,3%
- Publication
- Mise à jour
Produits et versions concernés
huizhi-chargeos-cloud
- Versions du logiciel
- ≥ 0, ≤ 3.0.9: Concernée (custom)
Aucun correctif publié
Sources originales
- https://hackmd.io/@hieuPenguinnn/huizhi-chargeos-mp-member-api-userid-idor
- https://github.com/roinli/HUIZHI-ChargeOS-cloud/blob/1a2cbab79bb7abe7df3b4f9977f5d0e18e65bd4a/hcp-modules/hcp-mp/src/main/java/com/hcp/mp/controller/PayController.java#L18-L28
- https://www.vulncheck.com/advisories/huizhi-chargeos-cloud-through-3.0.9-unpaid-wallet-credit-via-pay-xcxrecharge
- https://nvd.nist.gov/vuln/detail/CVE-2026-111698