CVE-2026-111698

HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.

Organizations using ChargeOS may suffer financial losses due to unauthorized wallet balance modifications and free use of charging services. The vulnerability also enables manipulation of user financial data.

Immediately update ChargeOS to a version later than 3.0.9 or apply the vendor patch. Until then, restrict access to the xcxRecharge endpoint and monitor for unusual balance changes.