This vulnerability in Zhonglun CloudPOS 3.0 arises from improper handling of input parameters (version/url/packagekey/package name) in the Automatic Update component's Program.cs file. Exploiting this flaw allows an attacker to access a channel intended only for endpoints, potentially bypassing intended access controls. The attack vector is remote network-based with high complexity, no required privileges, and no user interaction. The vulnerability has a CVSS 4.0 score of 6.3, indicating medium severity. Public exploit code is available, but no vendor response or patch has been provided.

Successful exploitation could allow unauthorized remote access to a communication channel within the CloudPOS system, potentially enabling further unauthorized actions or information disclosure. However, the attack complexity is high, and no privileges or user interaction are required, which somewhat limits the ease of exploitation. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, monitor for updates from Zhonglun. Consider restricting network access to the affected service and applying compensating controls to limit exposure until a patch is released.