mH-DEVELOPER CVE-2026-82936

Requires adjacent/LAN network access to the mH-DEVELOPER device's fh-node HTTP service; the Express bodyParser must be configured with its default 250 MB limit for JSON and URL-encoded bodies (as shipped pre-3.0.30). Nominally an authenticated LAN user (PR:L) is needed, but in practice authentication is not required because sibling flaw CVE-2026-82930 lets all endpoints be queried unauthenticated. A key LIMITING factor: success is probabilistic and depends on the device's current memory usage, which the attacker does not fully control (reflected as AT:P), so the crash is not reliably deterministic. Exploitation is bounded to adjacent-network reach, not internet-facing, and impact is availability only.

The vendor CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:L/UI:N, VA:H only) scores 5.9 (medium) and correctly captures a LAN-adjacent, availability-only Denial-of-Service issue with no confidentiality or integrity impact. The AT:P (attack requirement present) metric is well-justified: the description explicitly states success 'depends on the current memory usage of the device which is not under full control of the attacker,' making the crash probabilistic rather than deterministic. Nominally the vector requires PR:L (authenticated LAN user), but the description notes that because of the sibling flaw CVE-2026-82930 (missing token verification) all endpoints can be queried unauthenticated - so in a real deployment the effective privilege requirement collapses to PR:N, raising practical risk above the nominal score. Countervailing signals keep this low priority: no EPSS score, no CISA KEV listing, and no public POC identified at time of analysis; the impact is a single-process crash (recoverable on restart) with no data exposure or code execution. This is a genuine but modest availability issue in a niche product, not a high-urgency threat - an adjacent-network attacker, not internet-facing exposure, and the memory-state dependency further limits reliability.

An attacker with LAN access (e.g., a compromised device, guest Wi-Fi, or malicious insider on the building network) sends one or more HTTP requests with JSON or URL-encoded bodies approaching the 250 MB bodyParser limit, forcing the fh-node process to buffer them in RAM. When device memory is already partly consumed, this triggers an out-of-memory condition and crashes the process, taking down the smart-home automation until it restarts. No public exploit code is identified, but the technique is trivial to reproduce and requires no authentication in practice due to CVE-2026-82930.