EUVD-2026-14408
GHSA-vmxp-224r-5qhc
Severity by source
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
A flaw has been found in Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N. This affects an unknown part of the component Cardholder Data Handler. Executing a manipulation can lead to cleartext transmission of sensitive information. The attack requires access to the local network. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
The Shenzhen HCC Technology MPOS M6 PLUS device running firmware version 1V.31-N contains a cleartext transmission vulnerability in its Cardholder Data Handler component that allows attackers on the local network to intercept sensitive information. An attacker with network access can manipulate the affected component to force transmission of cardholder data in cleartext, compromising payment card information. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Vulnerability AssessmentAI
| Risk Assessment | Despite the low CVSS score of 3.1, this vulnerability warrants elevated attention due to several risk factors: first, a public proof-of-concept exists on GitHub (https://github.com/Davim09/m6plusexploit), significantly lowering the barrier to exploitation; second, the vulnerability affects payment processing hardware directly, meaning successful exploitation results in direct compromise of cardholder data (high business impact despite limited technical CVSS impact); third, the vendor (Shenzhen HCC Technology) has not responded to disclosure attempts and no patch timeline exists, leaving affected deployments in perpetual vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker positioned on the same local network as a deployed MPOS M6 PLUS terminal (e.g., shared corporate WiFi, coffee shop network, or compromised network segment) uses the publicly available proof-of-concept code from GitHub to manipulate the Cardholder Data Handler component into transmitting sensitive cardholder information in cleartext. By passively monitoring network traffic or actively triggering payment transactions, the attacker captures full or partial card data including PAN, expiry, and potentially CVV information, which can then be used for fraudulent transactions or sold on underground markets. … |
| Remediation | Primary remediation is to upgrade the MPOS M6 PLUS firmware to a patched version once available from Shenzhen HCC Technology; however, given the vendor's non-responsiveness, users should contact the vendor directly to request a security patch or consider evaluating alternative payment processing hardware from vendors with active security practices. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
During next maintenance window: Apply vendor patches when convenient. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today