CVE-2026-97866

Deferred Deferred - Pending Action

Remote Code Execution in Zhonglun CloudPOS

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: VulDB

Description

A weakness has been identified in Zhonglun CloudPOS 3.0. Affected by this vulnerability is an unknown functionality of the file Program.cs of the component Automatic Update. Executing a manipulation of the argument version/url/packagekey/package name can lead to channel accessible by non-endpoint. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitation appears to be difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97866

EUVD

EUVD-2026-87110

Affected Vendors & Products

Vendor	Product	Version / Range
zhonglun	cloudpos	3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-300	The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Zhonglun CloudPOS 3.0, specifically in the Automatic Update component. It involves a manipulation of arguments like version, url, packagekey, or package name in the Program.cs file. This could allow unauthorized access to channels that should not be accessible to non-endpoint users. The attack is complex but has a public exploit available.

Detection Guidance

Detection of this vulnerability requires monitoring for unusual network traffic or unauthorized access attempts related to the Automatic Update component in Zhonglun CloudPOS 3.0. Check for unexpected version/url/packagekey/package name manipulations in logs. Inspect network traffic for connections to unknown endpoints or unusual update requests.

Impact Analysis

The impact includes potential unauthorized access to systems or data due to the channel accessibility flaw. Attackers could exploit this to gain control or extract sensitive information. The complexity of the attack limits its likelihood, but the public exploit increases risk.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating confidentiality requirements in GDPR and HIPAA. Non-compliance risks include fines or legal penalties due to potential data breaches or unauthorized system access.

Mitigation Strategies

Isolate affected systems running Zhonglun CloudPOS 3.0. Disable the Automatic Update component in Program.cs if possible. Monitor network traffic for unusual update requests. Apply vendor patches if available or consider replacing the software.

Hi! I’m here to help you understand CVE-2026-97866. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70