CVE-2026-108901
Shenzhen HCC Technology MPOS M6 PLUS Display QR Code Rendering ui layer
- State
- Published
- Severity
- 5.1 Medium
- Published
- Oct 12, 2026
- Updated
- Oct 13, 2026
- Reserved
- Oct 11, 2026
Description
A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack can only be performed from the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 3.5 Low | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 3.5 Low | CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 3.3 Low | AV:A/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-1021 Improper Restriction of Rendered UI Layers
Affected Products
| Product | Versions |
|---|---|
MPOS M6 PLUSShenzhen HCC Technology |
|
References
- VDB-416692 | Shenzhen HCC Technology MPOS M6 PLUS Display QR Code Rendering ui layervdb-entrytechnical-description
- VDB-416692 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-108901 | CVE Analysis and Reportthird-party-advisory
- Submit #976764 | Shenzhen HCC Technology Co., Ltd M6PLUS MPOS M6PLUS-FW-1V.31-N Display Injectionthird-party-advisory
- https://github.com/Davim09/m6plusexploit/blob/main/docs/CVE-4-DisplayInjection.mdexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.