This vulnerability affects the OpenLocalBrowser function in the ZlPos/ZlPos/Bizlogic/JSBridge.cs file of Zhonglun CloudPos up to version 3.0.1.76. An attacker can remotely manipulate the url argument passed to this function, resulting in code injection. The vulnerability has been publicly disclosed, but the vendor has not provided a response or patch. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and limited impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to inject and execute arbitrary code via the url parameter in the OpenLocalBrowser function. This can compromise the affected system's integrity and potentially lead to further system compromise. The vulnerability does not require authentication or user interaction, increasing its risk. However, the impact is rated medium due to limited scope of confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should consider restricting network access to the affected component and monitor for suspicious activity related to the OpenLocalBrowser function. Avoid using affected versions until a vendor fix is released.