---
id: CVE-2026-97866
title: A weakness has been identified in Zhonglun CloudPOS 3.0
summary: >-
  A weakness has been identified in Zhonglun CloudPOS 3.0. Affected by this
  vulnerability is an unknown functionality of the file Program.cs of the
  component Automatic Update. Executing a manipulation of the argument
  version/url/packagekey…
severity: medium
cvss: 5.6
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-300
vendor: Zhonglun
product: CloudPOS
affected:
  - CloudPOS 3.0
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T16:17:31.400'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97866'
references:
  - url: 'https://github.com/user-attachments/files/30572292/CloudPos.docx'
    label: cna@vuldb.com
  - url: 'https://github.com/xy-f0/CVE/issues/4'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-97866'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/911606'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/409883'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/409883/cti'
    label: cna@vuldb.com
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-25T15:23:43.426944Z'
ingestedAt: '2026-09-25T15:10:56.361Z'
---

## Overview

A weakness has been identified in Zhonglun CloudPOS 3.0. Affected by this vulnerability is an unknown functionality of the file Program.cs of the component Automatic Update. Executing a manipulation of the argument version/url/packagekey/package name can lead to channel accessible by non-endpoint. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitation appears to be difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.