MPOS M6 PLUS EUVD-2026-97511

Exploitation requires the attacker to be on the same local/adjacent network as the MPOS M6 PLUS terminal (AV:A) - it cannot be triggered from the internet - and requires a user to interact with the rendered display (UI:P). The specific prerequisite is reaching the Display QR Code Rendering component and supplying a manipulated 'alignment' argument to distort the layering of the rendered UI. Limiting factors that reduce realistic risk: mandatory adjacent-network position, mandatory victim interaction with the manipulated UI, no authentication bypass of consequence (impact is limited to low integrity, VI:L), and no confidentiality or availability impact. No special non-default product configuration is cited as required by the description.

This is a low-to-moderate real-world priority despite a public exploit. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:P) confirms the attack is limited to the adjacent/local network - it is NOT remotely exploitable over the internet - and requires victim user interaction (UI:P), both of which sharply constrain realistic exploitation. Impact is narrow: only low integrity impact (VI:L) with no confidentiality or availability loss, consistent with CWE-1021 (improper restriction of rendered UI layers, i.e. UI redressing/clickjacking rather than code execution or data theft). Publicly available exploit code exists (GitHub POC) and the SSVC/4.0 Exploit Maturity is E:P (proof-of-concept), but there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation. Note a signal conflict: the input Tags label this 'XSS', yet the assigned CWE-1021 and the description ('improper restriction of rendered ui layers') describe UI-layer/clickjacking manipulation, not classic cross-site scripting (CWE-79) - this discrepancy should be verified. Overall the modest CVSS 5.1, adjacent-only vector, required user interaction, and absence of KEV/EPSS signals outweigh the existence of a POC, placing this below internet-facing or wormable issues in remediation priority.

An attacker already present on the same local network as the MPOS M6 PLUS terminal manipulates the 'alignment' argument of the Display QR Code Rendering component to overlay or reposition rendered UI layers, presenting a deceptive display to the operator or customer. When the user interacts with the manipulated interface (UI:P), they may approve or act on content different from what they believe they see. A proof-of-concept exploit is publicly available on GitHub.