Insecure direct object reference in HUIZHI ChargeOS cloud exposes member data
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference flaw in the hcp-mp MeController and OrderController. The endpoints trust client-supplied userId, openId and orderNumber values without checking ownership (CWE-639). A remote attacker with low privileges can enumerate sequential member ids to read any member's wallet, credit, profile and charging orders.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version is listed for HUIZHI ChargeOS cloud.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111697
- 2026-10-16 CISA SSVC decision points changed
- 2026-10-16 Alias added: GHSA-7f2r-7vg5-f3wp
References
Other 2
- https://github.com/roinli/HUIZHI-ChargeOS-cloud/blob/1a2cbab79bb7abe7df3b4f9977f5d0e18e65bd4a/hcp-modules/hcp-mp/src/main/java/com/hcp/mp/controller/MeController.java#L40-L91
- https://github.com/roinli/HUIZHI-ChargeOS-cloud/blob/1a2cbab79bb7abe7df3b4f9977f5d0e18e65bd4a/hcp-modules/hcp-mp/src/main/java/com/hcp/mp/controller/OrderController.java#L59-L87
More roinli vulnerabilities
- TI-2026-75484 Missing authorization in HUIZHI ChargeOS cloud lets attackers alter balances CVSS 4.0HIGH 7.1
Sources
- CVE-2026-111697 · CVE Program
- CVE-2026-111697 · NVD
- FIRST EPSS
- GHSA-7f2r-7vg5-f3wp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences