CVE-2026-111698: HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs privileges to send requests to the affected endpoint. No user interaction is required, and the attack can be performed over the network.
Which deployments are affected?
HUIZHI ChargeOS cloud versions through 3.0.9 are affected. The provided information does not identify a configuration prerequisite or a fixed version.
What is the practical impact of successful exploitation?
An attacker can supply arbitrary amount and userId parameters to alter another member's wallet balance, including crediting it without payment or reducing it. This can enable consumption of charging services without paying.