CVE-2026-108901
Received Received - Intake

Improper UI Layer Rendering in HCC Technology MPOS M6 PLUS

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack can only be performed from the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108901
EUVD
EUVD-2026-97511

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Shenzhen HCC Technology MPOS M6 PLUS 1.31-N

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1021 The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108901 is an unauthenticated display and QR code injection vulnerability in the Shenzhen HCC Technology MPOS M6 PLUS payment terminal. It allows attackers within Bluetooth range to send arbitrary content to the terminal's display or QR code without authentication, bypassing pairing or PIN requirements. This includes injecting fraudulent PIX QR codes, social engineering messages, or fake transaction screens.

Detection Guidance

Detecting this vulnerability requires monitoring for unauthorized Bluetooth SPP/RFCOMM commands targeting the MPOS M6 PLUS terminal. Check for unexpected QR code injections or display changes during transactions. Use Bluetooth sniffing tools like hcitool, bluetoothctl, or Wireshark to capture and analyze Bluetooth traffic for proprietary opcodes or BR Code strings. Inspect terminal logs for anomalies in display rendering or QR code generation.

Impact Analysis

This vulnerability can lead to payment fraud where attackers redirect payments to their accounts by injecting malicious QR codes. It also enables social engineering attacks through fake confirmations or phishing prompts displayed on the terminal. The attack is quick, leaves no trace, and persists until a timeout or restart.

Mitigation Strategies

Immediately restrict Bluetooth access to the terminal by disabling unnecessary Bluetooth services or pairing only trusted devices. Update firmware if a patch is available. Implement visual indicators on the terminal to alert users of injected content. Add authentication for display and QR code rendering commands. Monitor for suspicious Bluetooth activity near payment terminals.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108901. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart