EUVD-2026-87142
GHSA-x838-phcw-3pqw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted url to CloudPos client
-
DeliveryReach JSBridge OpenLocalBrowser handler
-
ExploitInject code via url argument
-
ExecutionExecute code in CefSharp app context
-
ImpactControl POS terminal
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the Zhonglun CloudPos desktop client (versions up to 3.0.1.76) with its CefSharp-based JSBridge component active, and the ability to get an attacker-controlled value into the 'url' argument of the OpenLocalBrowser function in ZlPos/ZlPos/Bizlogic/JSBridge.cs. Exploitation is limited by the need to have the POS terminal load or process the malicious url (a client-side bridge, so in practice some operator interaction or attacker-influenced content delivery is likely despite the input's UI:N claim), and by the product's narrow deployment. No authentication is indicated by the provided vector (PR:N), but this is unverified by the vendor. |
| Impact | Signals conflict, and the source is a low-tier one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with E:P yields a moderate 6.9, but the impact metrics are all Low (VC:L/VI:L/VA:L) - this is inconsistent with the CWE-94 code-injection classification and the 'RCE' tag/exploit filename (CloudPos.CefSharp.RCE.docx), which imply full code execution and should map to High impacts. The vector also claims UI:N, yet a JSBridge 'OpenLocalBrowser' method taking an attacker-supplied url in a desktop CefSharp POS client realistically requires the terminal to load or process attacker-controlled content, which usually means some user/operator interaction - so the pure remote-unauthenticated framing (typical of VulDB submissions) should be verified. There is no CISA KEV entry and no EPSS score provided, so despite public exploit code (E:P / PoC) this reads as an opportunistically disclosed, low-prevalence issue rather than a mass-exploited priority. Net: a genuine code-injection bug with a public PoC, but real-world urgency is limited by the niche, non-enterprise product footprint and the unconfirmed remote/no-interaction claims. |
| Exploit ScenarioDerived | An attacker crafts a malicious url and gets the CloudPos terminal's embedded CefSharp browser to invoke the JSBridge OpenLocalBrowser function with it, injecting and executing attacker code within the POS application context. A public PoC exists (a CloudPos.CefSharp.RCE document attached to the disclosure), lowering the bar to reproduce. Because the vector is network-facing but the injection point is a client-side JS bridge, delivery most plausibly relies on the terminal loading attacker-influenced content. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Code injection in the Zhonglun CloudPos desktop client (versions up to and including 3.0.1.76) allows remote attackers to inject and execute code through the 'url' argument of the OpenLocalBrowser function in the CefSharp-based JSBridge component (ZlPos/ZlPos/Bizlogic/JSBridge.cs), with the vendor's own CVE record pointing to RCE as the practical outcome. Publicly available exploit code exists - a proof-of-concept document titled 'CloudPos.CefSharp.RCE' is linked from the disclosure - so the attack is both demonstrable and reproducible. The vendor was contacted but did not respond, so no vendor-released patch has been identified; exploitation requires the affected desktop client to process an attacker-influenced url (the independent assessment rates UI:R, implying some operator interaction or attacker-controlled content delivery is likely despite the CVSS 4.0 vector's UI:N claim). The CPE entry uses a wildcard version range, so all released builds up to 3.0.1.76 should be treated as affected.
RemediationAI
No vendor-released patch identified at time of analysis - the vendor was contacted early but did not respond, and no fixed version is published, so the wildcard CPE range (all builds through 3.0.1.76) should be treated as unpatched. Until Zhonglun issues a fix, apply compensating controls at the client and network layers: block or strictly allow-list the URL schemes, hosts, and parameter patterns accepted by the JSBridge OpenLocalBrowser call (in a CefSharp host this means validating the url argument before it reaches any shell, browser-launch, or process-spawn sink), and remove or disable the bridge binding entirely where the POS workflow does not require it - the trade-off being that any feature depending on launching a browser from the web UI will stop working. Confine CloudPos terminals to a segmented network with egress filtering so a successful injection cannot easily reach internal services or download secondary payloads, understanding that this reduces but does not eliminate local execution impact. Harden the operator-facing side of the chain, since the independent assessment requires user interaction (UI:R): restrict who can supply content the client will render, and train staff not to open untrusted POS content or links - treat this as a risk reduction measure rather than a fix. Monitor the disclosure thread at https://github.com/xy-f0/CVE/issues/5 and the vendor record at https://vuldb.com/vuln/409887 for a patched release, and if the vendor remains unresponsive, evaluate replacing the affected client version as an architectural rather than tactical response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-94 code injection in the JSBridge layer that mediates between the CloudPos desktop application's web front-end and its native .NET/C
host code. The JSBridge.cs file exposes an OpenLocalBrowser function whose 'url' argument is passed onward without adequate validation or allow-listing, letting attacker-controlled input reach a code-execution sink rather than being confined to plain navigation. In CefSharp-based applications the bridge is the trust boundary between JavaScript running in the embedded Chromium view and OS-level APIs, so any unsanitised value crossing that boundary can pivot from a script-context bug into native command or parameter injection, which is consistent with the 'RCE' tag applied to this CVE. The affected product is a POS/point-of-sale terminal application, so exploitation is constrained by the deployment footprint of the client and by the need to deliver a malicious url into the bridge's reach. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L, E:P) indicates low confidentiality, integrity, and availability impact with a proof-of-concept exploit maturity rating, while the independent assessment (CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores the same code-injection primitive as high impact but with user interaction required - a discrepancy that reflects the client-side, delivery-dependent nature of the exploit chain rather than a disagreement over the vulnerability class.
Know when Cloudpos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CWE-94 code injection into the client app context yields high C/I/A; UI:R because a JSBridge url handler realistically requires the terminal to load attacker content, unlike the source's UI:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in Zhonglun CloudPos up to 3.0.1.76. This issue affects the function OpenLocalBrowser of the file ZlPos/ZlPos/Bizlogic/JSBridge.cs of the component JSBridge. Such manipulation of the argument url leads to code injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB