Vulnerabilitates in F&F Filipowski mH-DEVELOPER machinis

CVE ID

CVE-2026-82928

Publication date

28 Septembris 2026

Vendor

F&F Filipowski

Product

mH-DEVELOPER

Vulnerable versions

Omnes ante 3.0.30

Vulnerability type (CWE)

Inclusio Features Non Documentorum vel Chicken Bits (CWE-1242)

Report source

Reportare ad CERT Polska

CVE ID

CVE-2026-82929

Publication date

28 Septembris 2026

Vendor

F&F Filipowski

Product

mH-DEVELOPER

Vulnerable versions

Omnes ante 3.0.30

Vulnerability type (CWE)

Usus Clavis Cryptographic Hard-coded (CWE-321)

Report source

Reportare ad CERT Polska

CVE ID

CVE-2026-82930

Publication date

28 Septembris 2026

Vendor

F&F Filipowski

Product

mH-DEVELOPER

Vulnerable versions

Omnes ante 3.0.30

Vulnerability type (CWE)

Defectus Authenticationis pro Functione Critica (CWE-306)

Report source

Reportare ad CERT Polska

CVE ID

CVE-2026-82932

Publication date

28 Septembris 2026

Vendor

F&F Filipowski

Product

mH-DEVELOPER

Vulnerable versions

Omnes ante 3.0.30

Vulnerability type (CWE)

Impropria Restrictio Communicationis Canalis ad Destinata Finis (CWE-923)

Report source

Reportare ad CERT Polska

CVE ID

CVE-2026-82933

Publication date

28 Septembris 2026

Vendor

F&F Filipowski

Product

mH-DEVELOPER

Vulnerable versions

Omnes ante 3.0.30

Vulnerability type (CWE)

Fides in HTTP pro HTTPS (CWE-1428)

Report source

Reportare ad CERT Polska

CVE ID

CVE-2026-82935

Publication date

28 Septembris 2026

Vendor

F&F Filipowski

Product

mH-DEVELOPER

Vulnerable versions

Omnes ante 3.0.30

Vulnerability type (CWE)

- Usus Componentium Tertiae Partis Non Manutenentium (CWE-1104)

Report source

Reportare ad CERT Polska

CVE ID

CVE-2026-82936

Publication date

28 Septembris 2026

Vendor

F&F Filipowski

Product

mH-DEVELOPER

Vulnerable versions

Omnes ante 3.0.30

Vulnerability type (CWE)

Allocatio Rerum Sine Limitibus vel Throttling (CWE-770)

Report source

Reportare ad CERT Polska

Description

Durante sua ipsius investigatione, Krzysztof Chudzik ex CERT Polska vulnerabilitates in F&F Filipowski mH-DEVELOPER machinis detexit. Investigatio per GLM 5.2 LLM peracta est, inventa manualiter verificata sunt et cum venditore consultata. CERT.PL turma disclosurem dictarum vulnerabilitatum coordinavit.

Vulnerabilitas CVE-2026-82928: mH-DEVELOPER modulorum domus callidi clavis SSH publicam hardcoded in /root/.ssh/authorized_keys continet, quae ut potentialis backdoor fungitur. Daemon SSH sinit login radicis per authenticationem clavium et automatice incipit. Impugnator cum clavi privata congruente potest radicem shell in quolibet affecto machina obtinere, quod ad plenam systematis compromissionem ducit. Clavis sine remounting systematis file tolli non potest et post reset fabricam supervivet. Venditor notat hanc functionem tantum ad servitium usum fuisse.

Vulnerabilitas CVE-2026-82929: mH-DEVELOPER modulorum domus callidi eadem SSH host claves hard-coded in omni machina utitur, sine generatione clavis per machinam. Impugnator qui has claves ex firmware extrahit potest server SSH malitiosum constituere quod clientes sine admonitione credent, permittens impugnationes man-in-the-middle et interceptionem credentium.

Vulnerabilitas CVE-2026-82930: mH-DEVELOPER modulorum domus callidi tokens in sua authorizatione middleware non verificat, relinquens omnes HTTP API et WebSocket fines accessibiles sine authenticatione. Impugnator non authentificatus in LAN has fines interrogare potest, informationem systematis accedere, et imperata rudia mittere ad machinas automationis aedificii manipulandas.

Vulnerabilitas CVE-2026-82932: mH-DEVELOPER modulorum domus callidi nullas regulas firewall in initio onerat. Hoc omnes servitia audiens, inclusa SSH, HTTP, WebSocket, et Node-RED, plene exposita in LAN sine accessu control. Quisquis client in eadem rete ad omnia servitia pervenire potest.

Vulnerabilitas CVE-2026-82933: mH-DEVELOPER modulorum domus callidi suum interfaciem web et API traffic per HTTP non encryptum mittit. Passwords, tokens authenticationis, et imperata machinum in claro textu transmittuntur. Impugnator in eadem rete hanc traffic interceptare potest, credentia et tokens furari, et sessiones rapere.

Vulnerabilitas CVE-2026-82935: mH-DEVELOPER modulorum domus callidi cum fine vitae, non sustentato Debian 8 et Node.js runtime v17.0.1 in sua firmware productionis venit. Hoc machinam vulnerabilitatibus publice notis exponit quae non accipient patchs securitatis. Impugnator has notas notas ad codicem arbitrarium exsequendum, ad data sensitiva accedendum, vel ad negationem servitii in machina causandum potest.

Vulnerabilitas CVE-2026-82936: mH-DEVELOPER modulorum domus callidi vulnerabilis est ad Negationem Servitii ob incontrolled consumptio rerum. Express bodyParser cum limite 250 MB configuratur pro JSON et URL-encoded petitionibus. Impugnator authentificatus in LAN magnas petitiones mittere potest quae buffers in RAM exhaurientes, condiciones memoriae exhaurientes causans et processum fh-node frangens, quod ad negationem servitii ducit. Impugnatio successu pendet a currente usu memoriae machinae quae non sub pleno imperio impugnatoris est. Critice, ob CVE-2026-82930 omnes fines interrogari possunt non authentificati, ita quisquis usor in LAN hanc impugnationem perficere potest.

Haec problemata in versione 3.0.30 correcta sunt.

Plura de processu disclosure vulnerabilitatis coordinatae apud CERT Polska in https://cert.pl/en/cvd/ inveniuntur.

Vulnerabilitates Relatae

CVE-2026-82936 CVSS 5.9 MEDIUM Deferred

CVE-2026-82936 - Denial of Service in mH-DEVELOPER

mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with a 250 MB limit for JSON and URL-encoded request bodies. An authenticated attacker on the LAN can send large request bodies that exhausts buffers in RAM, causing out-of-memory conditions and crashing the fh-node process, resulting in denial of service. The successful attack depends on the current memory usage of the device which is not under full control of the attacker. Critically, due to CVE-2026-82930 all endpoints can be queried unauthenticated, so any user on LAN can perform this attack. This issue was fixed in version 3.0.30

CVE-2026-82935 CVSS 6.9 MEDIUM Deferred

CVE-2026-82935 - Use of End-of-Life components in mH-DEVELOPER

mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. This exposes the device to publicly known vulnerabilities that will not receive security patches. An attacker could exploit these known flaws to execute arbitrary code, access sensitive data, or cause a denial of service on the device. Vulnerable components were updated or hardened, if update was not possible in version 3.0.30

CVE-2026-82933 CVSS 6 MEDIUM Deferred

CVE-2026-82933 - Cleartext Transmission of Sensitive Information in mH-DEVELOPER

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This issue was fixed in version 3.0.30

CVE-2026-82932 CVSS 5.3 MEDIUM Deferred

CVE-2026-82932 - Missing Firewall Configuration in mH-DEVELOPER

mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service. This issue was fixed in version 3.0.30

CVE-2026-82930 CVSS 6.4 MEDIUM Deferred

CVE-2026-82930 - Missing Authentication in mH-DEVELOPER

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to manipulate building automation devices. This issue was fixed in version 3.0.30

CVE-2026-82929 CVSS 6.3 MEDIUM Deferred

CVE-2026-82929 - Use of Shared Cryptographic Key in mH-DEVELOPER

mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential interception. This issue was fixed in version 3.0.30

CVE-2026-82928 CVSS 7.7 HIGH Deferred

CVE-2026-82928 - Undocumented access path in mH-DEVELOPER

mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected device, resulting in full system compromise. The key cannot be removed without remounting the file system and survives a factory reset. Vendor notes that this functionality was used only for service purposes. This issue was fixed in version 3.0.30

Vulnerabilitates in F&F Filipowski mH-DEVELOPER machinis

Vulnerabilitates Relatae

Plura ex cert.pl