Zhonglun CloudPOS CVE-2026-97866

Exploitation requires the target to be running CloudPOS 3.0 with the Automatic Update component active, AND the attacker to occupy a man-in-the-middle / non-endpoint position on the network channel between the client and its update source (the CWE-300 precondition) so the version/url/packagekey/package-name arguments in Program.cs can be manipulated. Limiting factors: VulDB rates the attack as highly complex and exploitation as difficult (AC:H); no authentication is required (PR:N) and no user interaction is needed (UI:N), but the required interception position and complexity substantially constrain realistic exploitation. Impact is low across confidentiality, integrity, and availability.

This is a low-priority issue by every available signal. The CVSS 4.0 base score is only 2.9, driven by high attack complexity (AC:H) and uniformly low impact (VC:L/VI:L/VA:L, no subsequent-system impact). The weakness (CWE-300, channel accessible by non-endpoint) is a man-in-the-middle exposure in the CloudPOS 3.0 Automatic Update mechanism, where an interposed attacker can manipulate the version/url/packagekey/package-name arguments handled in Program.cs. VulDB's own text explicitly states the attack is 'highly complex' and 'exploitation appears to be difficult,' which is consistent with AC:H. A public artifact (a CloudPos.docx write-up) is referenced as an exploit, so publicly available exploit code/details exist - but this must NOT be conflated with active exploitation. There is no CISA KEV listing and no EPSS score supplied, so no evidence of real-world exploitation or high exploitation probability. Note a tension: the CVSS 4.0 vector lists AV:N, yet a CWE-300 non-endpoint channel attack realistically requires a privileged network position (interception between the client and update server), which is not typical 'remote from anywhere' access - treat the network-vector rating cautiously. Overall this is a genuinely low-risk, low-priority finding, not a high-CVSS-but-low-real-risk mismatch; the score itself is already low.

An attacker who can intercept or interpose on the network path between a CloudPOS 3.0 terminal and its update server (e.g., on a shared LAN, a compromised gateway, or via ARP/DNS spoofing) tampers with the automatic-update request parameters (version, url, packagekey, package name) to redirect or alter the update. A public write-up (CloudPos.docx) documenting the issue is available, but no evidence of active exploitation exists. Because the attack is rated highly complex and requires a man-in-the-middle position, practical exploitation is difficult.