CVE-2026-108901mediumCWE-1021

CVE-2026-108901: medium-severity vulnerability in Shenzhen HCC Technology MPOS M6 PLUS

Shenzhen HCC Technology MPOS M6 PLUS Display QR Code Rendering ui layer

Published · Updated

Follow this CVE+ Monitor MPOS M6 PLUS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.1epss 0.2%
A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack can only be performed from the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
Shenzhen HCC Technology · MPOS M6 PLUS
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Shenzhen HCC Technology MPOS M6 PLUS

In the same product, most dangerous first.

CVE-2026-4582LOWShenzhen HCC Technology MPOS M6 PLUS Bluetooth missing authenticationEPSS 0.3%CVE-2026-4583LOWShenzhen HCC Technology MPOS M6 PLUS Bluetooth authentication replayEPSS 0.3%CVE-2026-4584LOWShenzhen HCC Technology MPOS M6 PLUS Cardholder Data cleartext transmissionEPSS 0.2%