EUVD-2026-14399
GHSA-mh2m-j5hq-vv2j
Severity by source
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was detected in Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N. Affected by this issue is some unknown functionality of the component Bluetooth Handler. Performing a manipulation results in authentication bypass by capture-replay. The attack must originate from the local network. The attack is considered to have high complexity. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
This vulnerability is an authentication bypass in the Bluetooth Handler component of Shenzhen HCC Technology MPOS M6 PLUS version 1V.31-N, exploitable via capture-replay attacks. An unauthenticated attacker on the local network can manipulate Bluetooth communications to bypass authentication mechanisms and gain unauthorized access with high attack complexity. A proof-of-concept exploit is publicly available on GitHub, and the vendor has not responded to disclosure attempts, leaving affected systems without an official patch.
Technical ContextAI
The vulnerability resides in the Bluetooth Handler component of the MPOS M6 PLUS payment terminal, a device running version 1V.31-N as identified in CPE cpe:2.3:a:shenzhen_hcc_technology:mpos_m6_plus:*:*:*:*:*:*:*:*. The root cause is classified under CWE-294 (Authentication Using a Secondary Channel), which describes a flaw where authentication can be bypassed by exploiting an alternate communication path. In this case, the Bluetooth interface fails to implement proper cryptographic protections or nonce-based mechanisms against replay attacks, allowing an attacker to capture legitimate Bluetooth authentication frames and resubmit them to gain access. The MPOS M6 PLUS is a point-of-sale terminal commonly deployed in retail environments, making the Bluetooth interface a critical trust boundary for device pairing and configuration.
RemediationAI
No official patch from Shenzhen HCC Technology is available due to vendor non-response; organizations should contact the vendor directly to request security updates or consider alternative payment terminal solutions. Immediate compensating controls include restricting Bluetooth access by physically disabling Bluetooth radios where functionality is not required, isolating payment terminals on segregated network segments with strict access controls limiting communication to trusted devices, implementing network monitoring to detect suspicious Bluetooth pairing attempts or replay-attack signatures, and requiring strong administrative passwords for terminal configuration to create additional authentication layers. For organizations unable to replace affected terminals, implementing a zero-trust posture for terminal management—such as requiring multi-factor authentication for remote configuration and continuous monitoring of Bluetooth connections—can reduce attack surface. Document the vulnerability in your risk register and escalate to payment processor contacts to determine if they recommend terminal replacement or provide compensating controls guidance.
More in Mpos M6 Plus
View allUnauthenticated Bluetooth access in the Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N allows attackers on the local netwo
The Shenzhen HCC Technology MPOS M6 PLUS device running firmware version 1V.31-N contains a cleartext transmission vulne
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today