Remote Code Execution in Zhonglun CloudPOS 3.0 Automatic Update Feature
CVE-2026-97866

6.3MEDIUM

Key Information:

Vendor: Zhonglun
Status: Cloudpos
Vendor: CVE Published:; 25 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-97866?

A vulnerability exists in the Automatic Update feature of Zhonglun CloudPOS 3.0, stemming from an inadequate implementation of the Program.cs file. Manipulating certain parameters—such as the version, URL, package key, or package name—can grant unauthorized access to channels that should be restricted. While the complexity of the attack is high, the potential for exploitation remains concerning due to public availability of the exploit. Communication attempts with the vendor regarding this issue have gone unanswered.

Affected Version(s)

CloudPOS 3.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-97866 - Proof of Concept