roinli CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH roinli CVE published 2026-10-16

CVE-2026-111698

A missing authorization vulnerability exists in HUIZHI ChargeOS cloud through version 3.0.9, specifically in the hcp-mp PayController.xcxRecharge endpoint. This allows attackers to modify any member's wallet balance without payment by sending requests with arbitrary amount and userId parameters, effectively crediting or reducing balances and enabling free consumption of charging services.