HUIZHI ChargeOS EUVD-2026-102989

Exploitation requires a valid low-privilege member/mini-program account that can reach the hcp-mp PayController.xcxRecharge endpoint (authenticated, per PR:L); the attacker then supplies attacker-controlled userId and amount parameters that the endpoint fails to authorize against the caller's identity. Limiting factors: the attacker must be able to authenticate to the platform (the WeChat mini-program / member API must be exposed and registration or an existing account obtainable), and the deployment must be ChargeOS cloud at or below version 3.0.9. No special non-default configuration is otherwise needed and no user interaction is required, so against any reachable in-scope instance the barrier is only obtaining any member credential.

This is a credible, real-world priority despite a moderate 7.1 CVSS. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication (a standard app/mini-program member account) and no user interaction, with high integrity impact and no confidentiality or availability impact - consistent with a missing-authorization (IDOR, CWE-639) bug where any authenticated user can tamper with arbitrary accounts. The reporter (VulnCheck) provides a vendor-style advisory plus a public technical write-up and a direct link to the vulnerable source (PayController.java xcxRecharge, lines 18-28), which strongly corroborates the root cause but is NOT confirmation of active exploitation. No EPSS score, no CISA KEV listing, and no explicitly flagged exploit artifact were supplied in the input, so exploitation remains theoretical-but-easy rather than observed. The main signals are confirming (trivial exploitability, published analysis), while the missing signals (EPSS, KEV) are simply absent rather than conflicting - absence of EPSS/KEV here should be read as 'not yet scored/tracked,' not as low risk. Net: for any operator actually running ChargeOS cloud this is a high-priority financial-fraud bug; its limited blast radius across the global environment is a function of product footprint, not low technical severity.

An attacker registers or already holds a low-privilege member account on a HUIZHI ChargeOS cloud deployment (through v3.0.9), then sends a crafted request to the hcp-mp PayController.xcxRecharge endpoint supplying an arbitrary userId and amount. Because the endpoint never verifies that the caller owns the targeted wallet, the attacker credits their own (or any) balance without paying and then consumes EV charging services for free. A public technical write-up detailing the flaw exists, though no packaged exploit tool was flagged in the provided data.