CVE-2026-108901
3.5LowPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-1021
Impact
Attackers on the local network can spoof or overlay the on-screen QR code interface if a user interacts with the device. They need adjacent network access to tamper with the alignment argument.
Root cause
Improper restriction of rendered UI layers in the QR code display component allows UI manipulation via the alignment argument.
Affected systems
Shenzhen HCC Technology MPOS M6 PLUS 1.31-N
CVSS v3.1 · CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Fix & remediation
No patch is currently available as the vendor did not respond. Isolate affected MPOS devices on a dedicated, restricted VLAN to block unauthorized local network access.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack can only be performed from the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.