The vulnerability allows manipulation of argument alignment in the Display QR Code Rendering component, resulting in improper restriction of rendered UI layers. This flaw permits an attacker to view or interact with UI components that should be protected, potentially exposing sensitive information displayed by the device. The weakness arises from an improper handling of rendering arguments, as identified by CWE-1021.

Shenzhen HCC Technology MPOS M6 PLUS, firmware version 1.31-N. The vulnerability is limited to the MPOS M6 PLUS product and is triggered via a local network attack vector.

The CVSS score of 5.1 indicates moderate severity, while the EPSS score is not available, leaving uncertainty about how frequently this vulnerability is exploited. Exploitation requires local network access, meaning an attacker must be on the same LAN or within the reach of the device’s wireless network. A public exploit exists, but the vulnerability is not listed in CISA KEV, suggesting no known large‑scale attacks to date.