CVE-2026-111698 in ChargeOS
Summary
by MITRE • 10/16/2026
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The HUIZHI ChargeOS cloud platform, specifically versions up through 3.0.9, suffers from a critical missing authorization vulnerability within its hcp-mp PayController.xcxRecharge endpoint. This flaw represents a fundamental failure in access control mechanisms, where the server fails to verify whether the authenticated user initiating the request is authorized to modify the wallet balance of the target member identified by the userId parameter. In secure systems, financial operations such as adjusting account balances must be strictly bound to the identity of the requester or require explicit administrative privileges with proper validation chains. Here, the absence of these checks allows any authenticated attacker who can reach this endpoint to manipulate the financial state of arbitrary user accounts.
The technical nature of this vulnerability is classified under CWE-862, which denotes Missing Authorization. By exploiting this flaw, an adversary can send crafted HTTP requests containing arbitrary values for both the amount and userId parameters. The backend logic processes these inputs without validating that the current session's identity matches the target userId or possesses sufficient permissions to perform such a transaction. This allows the attacker to credit their own wallet with unlimited funds or debit other users' accounts, effectively bypassing all payment gateways and fraud detection systems designed to protect financial integrity within the application.
The operational impact of this vulnerability is severe, directly compromising the confidentiality, integrity, and availability of the service's economic model. Attackers can consume charging services for free by artificially inflating their wallet balances, leading to significant direct financial losses for the organization. Furthermore, if an attacker chooses to debit other users' accounts, it results in a loss of trust among legitimate customers and potential legal liabilities due to unauthorized fund transfers. The ability to arbitrarily modify balances undermines the core value proposition of the platform, which relies on accurate transaction recording and secure payment processing.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1078, specifically Valid Accounts, as it likely requires initial authentication but abuses those credentials for unauthorized actions. It also reflects aspects of T1496, Resource Hijacking, where the attacker leverages system resources (charging services) without proper authorization or payment. The exploitation path is straightforward and does not require complex chaining with other vulnerabilities, making it a high-risk issue that demands immediate attention from development and security teams responsible for maintaining the integrity of financial modules in cloud-based IoT platforms.
To mitigate this vulnerability, developers must implement robust server-side access control checks on all endpoints handling sensitive data modifications. Specifically, the PayController.xcxRecharge endpoint should enforce strict validation to ensure that the userId parameter matches the identity associated with the active session token or requires elevated administrative privileges for cross-account operations. Implementing role-based access control (RBAC) and ensuring that financial transactions are immutable except through verified payment flows will prevent unauthorized balance adjustments. Additionally, integrating input validation to restrict amount parameters to positive integers within reasonable bounds can provide an additional layer of defense against abuse. Regular security audits and penetration testing focusing on business logic flaws are essential to identify similar missing authorization issues across the application surface before they can be exploited in production environments.