Submit #976764: Shenzhen HCC Technology Co., Ltd M6PLUS MPOS M6PLUS-FW-1V.31-N Display Injection

A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS firmware 1V.31-N and classified as critical. This affects the Display and QR code rendering component of the Bluetooth protocol stack.

The M6PLUS terminal exposes display and QR code injection functionality over its unauthenticated Bluetooth Classic (SPP/RFCOMM) channel. Any device within Bluetooth range can send a proprietary TLV-structured command to inject arbitrary content into the terminal's display — including fraudulent PIX QR codes, fake transaction confirmation screens, and social engineering messages — without pairing, PIN, or any form of credential verification.

The root cause is the same missing authentication documented in CVE-2026-4582: the terminal accepts commands from any Bluetooth device that completes the SPP connection without challenge-response, token, or cryptographic verification. The vulnerability in this report is distinct in affected component (display/QR rendering vs Bluetooth channel access) and in impact class (UI misrepresentation and financial fraud vs unauthorized access), warranting a separate CVE assignment under CWE-1021 (Improper Restriction of Rendered UI Layers or Frame).

TECHNICAL DETAILS

All commands follow the same packet framing described in CVE-2026-4582:

[0x4D] [cmd_len_hi] [cmd_len_lo] [COMMAND_OPCODE] [tlv_len_hi] [tlv_len_lo] [TLV_data] [XOR_CRC]

The display and QR code functions are invoked via a common proprietary opcode. QR code content is carried in TLV tag 1F18 as a raw UTF-8 string (maximum 127 bytes). Display text is carried in tag 1F12 with support for line breaks (0x0A). Additional tags control timeout (1F10), title (1F12), status bar (1F13), and LED/buzzer (1F15, 1F16).

An additional implementation inconsistency was identified: the byte positions of the timeout and alignment fields within tag 1F10 differ between the QR code and text display command variants, while the firmware reads the timeout from a fixed byte offset regardless of command type. This causes the text display command to silently use the alignment field value as the effective timeout, ignoring the operator-configured duration.

EMPIRICALLY CONFIRMED IMPACT — PIX QR CODE SUBSTITUTION

Brazil's instant payment system (PIX) encodes payment instructions as BR Code QR codes (EMV Merchant-Presented QR Code specification). BR Code strings are not cryptographically signed — they contain the recipient PIX key, transaction amount, and merchant data, protected only by a CRC-16/CCITT-FALSE checksum. Any well-formed BR Code presented to a banking application is accepted as a valid payment instruction.

Attack scenario:
1. Attacker connects to terminal via Bluetooth (no pairing required — CVE-2026-4582)
2. Attacker sends a display command containing a BR Code with their own PIX key as content
3. Terminal renders the injected QR code, indistinguishable from a legitimate merchant QR
4. Customer scans with banking application, which processes payment to attacker's account
5. Merchant receives no indication of substitution; attacker disconnects within 2-5 seconds

This attack was executed against a physical M6PLUS terminal. The injected PIX BR Code was scanned and processed by a real Brazilian banking application, which confirmed the payment to the attacker-controlled PIX key. Full video proof of concept is attached to this submission.

ADDITIONAL ATTACK SURFACE

The same unauthenticated display primitive enables:
- Fake transaction confirmations to deceive merchants into releasing goods after failed payments
- Phishing URLs rendered as QR codes on a trusted physical payment surface
- Arbitrary text messages with social engineering content targeting customers or merchants
- Prompts requesting sensitive input typed on the terminal's physical keypad, with the response returned to the attacker over Bluetooth

RELATIONSHIP TO EXISTING CVEs

CVE-2026-4582 (CWE-306): shares root cause (no auth on Bluetooth). Different component and impact.
CVE-2026-4583 (CWE-294): no overlap — replay attack; display injection creates new packets.
CVE-2026-4584 (CWE-319): no overlap — cleartext data exposure vs outbound UI manipulation.

CVSS RATIONALE

Attack Vector: Adjacent (Bluetooth range, approximately 10m open space)
Attack Complexity: High (requires knowledge of proprietary protocol and BR Code format)
Privileges Required: None
User Interaction: Required (customer must scan the injected QR code)
Scope: Changed (vulnerability in terminal affects customer's banking application and financial account, a separate security domain)
Confidentiality: None
Integrity: High (financial transaction redirected to attacker-controlled account)
Availability: None
Estimated Base Score: 7.1 (High)

REMEDIATION

Vendor should implement authentication for display commands separate from general Bluetooth channel controls, or restrict display command acceptance to cryptographically verified paired devices. QR code content should be signed using a key derived from the terminal's secure element and verified by the banking application before processing as a payment instruction.

Vendor was contacted prior to disclosure. No response was received.

• Quelle: ⚠️ https://github.com/Davim09/m6plusexploit/blob/main/docs/CVE-4-DisplayInjection.md
• Benutzer: davimo (UID 79678)
• Einreichung: 14.09.2026 03:47 (vor 28 Tagen)
• Moderieren: 11.10.2026 16:47 (28 days later)
• Status: Akzeptiert
• VulDB Eintrag: 416692 [Shenzhen HCC Technology MPOS M6 PLUS 1.31-N Display QR Code Rendering alignment erweiterte Rechte]
• Punkte: 20