A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. (CVE-2026-108901)

CVE-2026-108901 describes a vulnerability in Shenzhen HCC Technology MPOS M6 PLUS version 1.31-N within an unspecified functionality of the Display QR Code Rendering component. The flaw arises from improper handling of the 'alignment' argument, leading to improper restriction of rendered UI layers. The attack vector is local network with low attack complexity, no privileges required, but requires user interaction. The vulnerability impacts integrity but not confidentiality or availability. The vendor was notified but did not respond, and no official patch or remediation is documented. Public exploit code exists, but no active exploitation is reported.

The vulnerability allows an attacker on the local network to manipulate UI rendering layers, potentially causing integrity issues in the user interface. There is no impact on confidentiality or availability. The low CVSS score (3.5) reflects limited impact and exploitation complexity. No known active exploitation in the wild has been reported.

No official patch or remediation is currently available. The vendor did not respond to disclosure requests. Users should restrict local network access to trusted parties and monitor for suspicious activity involving the Display QR Code Rendering functionality. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.