Search
Search Results (4 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-82932 | 2 F&f Filipowski, F F Filipowski | 2 Mh-developer, Mh-developer | 2026-09-28 | N/A |
| mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service. This issue was fixed in version 3.0.30 | ||||
| CVE-2026-82933 | 2 F&f Filipowski, F F Filipowski | 2 Mh-developer, Mh-developer | 2026-09-28 | N/A |
| mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This issue was fixed in version 3.0.30 | ||||
| CVE-2026-82929 | 2 F&f Filipowski, F F Filipowski | 2 Mh-developer, Mh-developer | 2026-09-28 | N/A |
| mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential interception. This issue was fixed in version 3.0.30 | ||||
| CVE-2026-82930 | 2 F&f Filipowski, F F Filipowski | 2 Mh-developer, Mh-developer | 2026-09-28 | N/A |
| mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to manipulate building automation devices. This issue was fixed in version 3.0.30 | ||||
Page 1 of 1.