MEDIUMCVSS v3.1 6.5Vulnerability
CVE-2026-111698
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-10-20T21:14:08.448323+00:00
- Epss score
- 0.00326
- Cvss score
- 6.5
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-10-21T01:24:48+00:00
- Last source
- FIRST EPSS
- Score
- 6.5
- Cvss version
- 3.1
- Cve id
- CVE-2026-111698
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- First seen by Signal
- 2026-10-18T13:39:03+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Published at
- 2026-10-16T18:17:53.490
- Last modified
- 2026-10-16T20:17:22.610
- Epss percentile
- 0.24205
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph