EUVD-2026-14408
GHSA-vmxp-224r-5qhc
Severity by source
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A flaw has been found in Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N. This affects an unknown part of the component Cardholder Data Handler. Executing a manipulation can lead to cleartext transmission of sensitive information. The attack requires access to the local network. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
The Shenzhen HCC Technology MPOS M6 PLUS device running firmware version 1V.31-N contains a cleartext transmission vulnerability in its Cardholder Data Handler component that allows attackers on the local network to intercept sensitive information. An attacker with network access can manipulate the affected component to force transmission of cardholder data in cleartext, compromising payment card information. A publicly available proof-of-concept exists on GitHub, and the vulnerability has a CVSS score of 3.1 (low severity) due to high attack complexity requirements, though the exploitation difficulty rating suggests real-world risk depends heavily on network proximity and attacker capabilities.
Technical ContextAI
This vulnerability represents a cleartext transmission flaw (CWE-319) in the payment processing stack of a mobile point-of-sale (MPOS) terminal. The affected component, identified as the Cardholder Data Handler, is responsible for managing and transmitting sensitive payment card information during transaction processing. The CPE identifier cpe:2.3:a:shenzhen_hcc_technology:mpos_m6_plus indicates the vulnerability affects the MPOS M6 PLUS product family across unspecified versions. CWE-319 (Cleartext Transmission of Sensitive Information) reflects the root cause: the application transmits cardholder data over unencrypted channels rather than enforcing TLS/SSL encryption. The attack vector is adjacent network (AV:A), meaning an attacker must be positioned on the same local network segment, and requires high attack complexity (AC:H), suggesting the manipulation requires specific knowledge of the device's protocol behavior or network state.
RemediationAI
Primary remediation is to upgrade the MPOS M6 PLUS firmware to a patched version once available from Shenzhen HCC Technology; however, given the vendor's non-responsiveness, users should contact the vendor directly to request a security patch or consider evaluating alternative payment processing hardware from vendors with active security practices. Immediate interim mitigations include: (1) isolate MPOS M6 PLUS devices on a segregated network segment using VLANs or dedicated payment networks with strict egress filtering to prevent sensitive data exfiltration, (2) implement network-level TLS inspection or VPN tunneling to force encrypted transport of all device traffic, (3) monitor network traffic to and from affected terminals for cleartext cardholder data patterns, and (4) enforce strict access control lists limiting which systems can communicate with the devices. Until patches are available, consider restricting deployment of M6 PLUS terminals in high-risk environments and prioritize replacement with payment processing solutions from vendors with responsive security programs.
More in Mpos M6 Plus
View allThis vulnerability is an authentication bypass in the Bluetooth Handler component of Shenzhen HCC Technology MPOS M6 PLU
Unauthenticated Bluetooth access in the Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N allows attackers on the local netwo
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today