A flaw in the Cardholder Data Handler component of Shenzhen HCC Technology's MPOS M6 PLUS 1V.31‑N allows an attacker to manipulate the system so that sensitive cardholder data is transmitted in cleartext. This vulnerability, categorized as CWE‑310 and CWE‑319, exposes customer payment information to anyone who can observe the local network traffic, leading to direct confidentiality compromise.

The affected product is the MPOS M6 PLUS handheld payment terminal produced by Shenzhen HCC Technology, specifically version 1V.31‑N. The flaw is present in an unknown part of the Cardholder Data Handler component, and the exploit requires local network access to the device.

The CVSS base score is 2.3, indicating a low overall severity, and no EPSS or KEV listing is available, which suggests limited public exploitation. However, the attack requires local network connectivity, high complexity, and is considered difficult to exploit. Because cardholder data is exposed in cleartext, the risk to confidentiality is significant if an attacker is able to intercept the traffic, even though the overall likelihood of exploitation is low.