mH-DEVELOPER CVE-2026-82932

Requires the attacker to be on the same LAN/network segment as the mH-DEVELOPER module (CVSS AV:A adjacent, not routable from the internet). No authentication and no user interaction are needed to reach the exposed services (PR:N/UI:N) because the device loads no firewall rules at startup by default, leaving SSH, HTTP, WebSocket, and Node-RED listening without access control. The limiting factor is network position: the flaw is not exploitable from outside the local network unless another device bridges access, and meaningful impact (device takeover) generally requires chaining one of the sibling vulnerabilities in the same advisory. Fixed in version 3.0.30.

This is a design/hygiene weakness (CWE-923) rather than a directly weaponizable memory-corruption or code-execution flaw. The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N, base 5.3) correctly places this on the ADJACENT network (LAN), not the internet - an attacker must already have a foothold on the same network segment. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active exploitation or opportunistic mass scanning. The real risk of this issue is as an ENABLER/amplifier: by loading no firewall rules at startup it leaves SSH, HTTP, WebSocket, and Node-RED reachable by any LAN client, which directly compounds the sibling flaws in the same CERT-PL advisory family (hardcoded SSH backdoor key CVE-2026-82928, missing token verification CVE-2026-82930, cleartext HTTP CVE-2026-82933). On its own the confidentiality/integrity impact is Low (service exposure/reconnaissance and reachability of unauthenticated interfaces); combined with those siblings it becomes a path to full device takeover. Net: NOT a standalone high-priority internet-facing threat, but a meaningful defense-in-depth failure on affected LANs. Note the tag 'Information Disclosure' only loosely fits - the core issue is missing network access control, not data leakage per se.

An attacker who has gained a position on the same LAN as the mH-DEVELOPER module (e.g. via a compromised Wi-Fi client or another IoT device) scans the host and finds SSH, HTTP, WebSocket, and Node-RED all listening with no firewall/access control. They connect directly to these interfaces to enumerate the device and then chain a sibling weakness - such as the unauthenticated API (CVE-2026-82930) or hardcoded SSH key (CVE-2026-82928) - to gain control. No public exploit code is identified for this specific CVE at time of analysis.