CafePlus EUVD-2026-38426

Attacker must be on a network adjacent to the CafePlus server (AV:A) - typically the same LAN, VLAN, or Wi-Fi segment as the POS deployment - and the target must be running CafePlus version 12.05.03. No authentication, user interaction, or special configuration is required (PR:N/UI:N/AC:L), as the affected critical function is exposed without ACL enforcement by default. Exploitation is limited by the requirement for layer-2/adjacent reachability - purely remote internet-based attacks are not possible unless the CafePlus service is improperly exposed beyond the LAN.

Risk is meaningful but bounded by the adjacent-network attack vector. CVSS 3.1 scores this 8.8 (High) with AV:A/AC:L/PR:N/UI:N and full C/I/A impact, meaning any unauthenticated user on the same broadcast domain can fully compromise the system with low complexity. No EPSS score, KEV listing, or public PoC was provided, so there is no evidence of active exploitation - risk is theoretical pending opportunistic discovery. Notably, the description states the issue affects versions 'from 12.05.03 before 12.05.04', implying 12.05.04 is the fix; this should be verified with the vendor as the only reference is the TR-CERT advisory rather than a direct vendor patch note. For cafes/hospitality networks where staff, guests, and POS terminals often share a flat Wi-Fi, AV:A is effectively equivalent to AV:N for malicious customers on guest Wi-Fi, materially elevating real-world risk.

An attacker who joins the same local network as a CafePlus server - for example, by connecting to a cafe's guest Wi-Fi - sends a request to a critical CafePlus function that fails to enforce authentication, gaining the ability to read or alter transactional data, inject commands, or disrupt service. No special tooling or credentials are required and the attack complexity is low, though no public exploit code is identified at time of analysis.