mH-DEVELOPER EUVD-2026-88230

Exploitation requires network adjacency: the attacker must be on the same LAN/building network as the mH-DEVELOPER module (AV:A), since the API and WebSocket endpoints are not exposed to be reached remotely across the internet. Beyond LAN presence there are NO further prerequisites - no authentication, no user interaction, and default configurations are affected because the authorization middleware itself fails to verify tokens on all endpoints. The primary limiting factor is the LAN-only reach; the primary amplifier is that any device on that network can fully control building-automation equipment. Fixed in version 3.0.30, so unpatched (<3.0.30) deployments are the exposed population.

The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N, base 6.4) describes a low-complexity, unauthenticated attack limited to the Adjacent (LAN) network - a meaningful mitigating factor, as it requires the attacker to already be on the same local/building network rather than reaching the device across the internet. The vector is internally coherent with the CWE-306 (Missing Authentication) description: the authorization middleware never verifies tokens, so all HTTP API and WebSocket endpoints are exposed. Notably the 4.0 vector rates vulnerable-system impact low (VC:L/VI:L/VA:L) but subsequent-system integrity and availability HIGH (SI:H/SA:H), reflecting that the real damage is downstream - the attacker can send raw control commands to manipulate physical building-automation devices. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no signal of active or automated exploitation; this is a real but not urgent priority. The dominant risk driver is the trivially exploitable auth bypass against a building-automation controller, tempered by LAN-only reach and no evidence of exploitation in the wild.

An attacker who gains a foothold on the building LAN (rogue device, compromised workstation, or guest Wi-Fi bridged to the automation network) directly queries the mH-DEVELOPER module's unauthenticated HTTP API or opens a WebSocket, enumerating system information without any credentials. They then issue raw control commands to actuate lighting, HVAC, access control, or other connected building-automation devices. No public exploit code is identified in the input, but the flaw is low-complexity and requires no authentication.