Read the docs
TI-2026-71038 Aliases CVE-2026-108901GHSA-rvqp-4f8r-8xg3

Rendered UI layer flaw in Shenzhen HCC MPOS M6 PLUS QR code display

Priority MEDIUM 56CWE-1021Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Spoofing
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-1021.

Summary

Shenzhen HCC Technology MPOS M6 PLUS from 1.31-N has an improper restriction of rendered UI layers in its Display QR Code Rendering component. Manipulating the alignment argument lets rendered UI layers escape proper restriction (CWE-1021). An attacker on the local network needs no privileges but needs a user to interact with the device. The exploit has been made public and is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack can only be performed from the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00203 10th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Shenzhen HCC TechnologyMPOS M6 PLUS1.31-N—No fix listedCNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:shenzhen_hcc_technology:mpos_m6_plus:*:*:*:*:*:*:*:*——Shenzhen HCC Technology

Remediation

The sources list no fixed version for MPOS M6 PLUS.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-108901
  2. 2026-10-12 Alias added: GHSA-rvqp-4f8r-8xg3
  3. 2026-10-13 CISA SSVC decision points changed
  4. 2026-10-13 Priority changed: LOW → MEDIUM

References

Exploit 1

  • TI-2026-03988 Shenzhen HCC Technology MPOS M6 PLUS Cardholder Data cleartext transmission CVSS 4.0LOW 2.3
  • TI-2026-03987 Shenzhen HCC Technology MPOS M6 PLUS Bluetooth authentication replay CVSS 4.0LOW 2.3
  • TI-2026-03986 Shenzhen HCC Technology MPOS M6 PLUS Bluetooth missing authentication CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences