Insufficient Access Control Vulnerability in Yungengxin Cloud Billing
CVE-2026-108889

4.8MEDIUM

Key Information:

Vendor

Yungengxin

Status
Cloud Billing
Vendor
CVE Published:
12 October 2026

What is CVE-2026-108889?

A security flaw has been identified in the Yungengxin Cloud Billing product version 2024.11.28.11 that affects the function sub_14000443C within the LWBilling64.sys library. This flaw enables an attacker to manipulate the argument Pid during local execution, leading to the exposure of ioctl operations without appropriate access controls. Notably, this vulnerability has been publicly disclosed, and the vendor was contacted regarding this issue but has not provided any response.

Affected Version(s)

Cloud Billing 2024.11.28.11

References

https://vuldb.com/vuln/416681
vdb-entrytechnical-description
https://vuldb.com/vuln/416681/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108889
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Element2023H (VulDB User)
VulDB CNA Team
.