Cloudpos
Monthly
Code injection in the Zhonglun CloudPos desktop client (versions up to and including 3.0.1.76) allows remote attackers to inject and execute code through the 'url' argument of the OpenLocalBrowser function in the CefSharp-based JSBridge component (ZlPos/ZlPos/Bizlogic/JSBridge.cs), with the vendor's own CVE record pointing to RCE as the practical outcome. Publicly available exploit code exists - a proof-of-concept document titled 'CloudPos.CefSharp.RCE' is linked from the disclosure - so the attack is both demonstrable and reproducible. The vendor was contacted but did not respond, so no vendor-released patch has been identified; exploitation requires the affected desktop client to process an attacker-influenced url (the independent assessment rates UI:R, implying some operator interaction or attacker-controlled content delivery is likely despite the CVSS 4.0 vector's UI:N claim). The CPE entry uses a wildcard version range, so all released builds up to 3.0.1.76 should be treated as affected.
Man-in-the-middle tampering with the Automatic Update channel in Zhonglun CloudPOS 3.0 lets an unauthenticated attacker who holds a non-endpoint position on the network path manipulate the version, url, packagekey and package-name arguments processed in Program.cs, potentially steering or altering the update flow. Exploitation requires no authentication and no user interaction, but VulDB rates the attack as highly complex and the practical difficulty of occupying the required interception position keeps the overall priority low, with only low confidentiality, integrity and availability impact. Publicly available exploit code exists (a proof-of-concept document is linked from the VulDB record), the issue is not listed in CISA KEV so there is no confirmation of active exploitation, and the vendor was contacted early but did not respond.
Code injection in the Zhonglun CloudPos desktop client (versions up to and including 3.0.1.76) allows remote attackers to inject and execute code through the 'url' argument of the OpenLocalBrowser function in the CefSharp-based JSBridge component (ZlPos/ZlPos/Bizlogic/JSBridge.cs), with the vendor's own CVE record pointing to RCE as the practical outcome. Publicly available exploit code exists - a proof-of-concept document titled 'CloudPos.CefSharp.RCE' is linked from the disclosure - so the attack is both demonstrable and reproducible. The vendor was contacted but did not respond, so no vendor-released patch has been identified; exploitation requires the affected desktop client to process an attacker-influenced url (the independent assessment rates UI:R, implying some operator interaction or attacker-controlled content delivery is likely despite the CVSS 4.0 vector's UI:N claim). The CPE entry uses a wildcard version range, so all released builds up to 3.0.1.76 should be treated as affected.
Man-in-the-middle tampering with the Automatic Update channel in Zhonglun CloudPOS 3.0 lets an unauthenticated attacker who holds a non-endpoint position on the network path manipulate the version, url, packagekey and package-name arguments processed in Program.cs, potentially steering or altering the update flow. Exploitation requires no authentication and no user interaction, but VulDB rates the attack as highly complex and the practical difficulty of occupying the required interception position keeps the overall priority low, with only low confidentiality, integrity and availability impact. Publicly available exploit code exists (a proof-of-concept document is linked from the VulDB record), the issue is not listed in CISA KEV so there is no confirmation of active exploitation, and the vendor was contacted early but did not respond.