Mh Developer
Monthly
Hardcoded root SSH access in F&F Filipowski's mH-DEVELOPER smart home module allows anyone who obtains the matching private key to log in as root over the always-running SSH daemon and fully compromise the device. The key is baked into /root/.ssh/authorized_keys, cannot be deleted without remounting the filesystem, and survives a factory reset, so the exposure persists until firmware 3.0.30 is installed. Attack surface is adjacent/local rather than Internet-wide (CVSS 4.0 7.7, AV:A/AC:H) and the private key is not published in the available sources, which is the main practical barrier; no public exploit code or confirmed active exploitation was identified at time of analysis. Vendor-released patch: 3.0.30.
Denial of service in F&F Filipowski mH-DEVELOPER smart home modules running versions prior to 3.0.30, where the Node.js-based fh-node service accepts JSON and URL-encoded bodies up to 250 MB through the Express bodyParser, allowing a LAN-adjacent attacker to exhaust device RAM and crash the process with out-of-memory conditions. The vendor's CVSS 4.0 vector rates this 5.9 (medium, AV:A/AC:L/AT:P/PR:L) and is availability-only with no confidentiality or integrity impact; successfully triggering the crash is probabilistic because it depends on the device's instantaneous memory usage, which the attacker does not fully control, hence the AT:P rating. Although the vector nominally requires privileges (PR:L), the accompanying assessment notes that sibling flaw CVE-2026-82930 allows all endpoints to be queried without authentication, so any LAN user can reach the vulnerable body-parsing path in practice. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; exploitation is bounded to adjacent-network reach rather than the internet. Vendor-released patch: 3.0.30.
The F&F Filipowski mH-DEVELOPER smart home module ships production firmware built on end-of-life Debian 8 and Node.js 17.0.1, both of which are past their support lifecycles and carry publicly documented, permanently unpatched vulnerabilities. Rather than containing one discrete exploitable flaw, the product is exposed because it bundles obsolete, unsupported third-party components (CWE-1104); an attacker who can reach and correctly trigger one of the known component CVEs in this firmware could achieve arbitrary code execution, data disclosure, or denial of service, and the network-reachable services require no authentication (CVSS vector signals PR:N). No public exploit identified at time of analysis, and no KEV listing, so this is best treated as a software-composition hygiene finding whose real-world risk is contingent on how exposed the device's services are; F&F addressed the issue in firmware 3.0.30.
Cleartext transmission of credentials, authentication tokens, and device commands in the mH-DEVELOPER smart home module (F&F Filipowski) exposes every web interface and API session to interception by anyone sharing the same local network segment. Every version prior to 3.0.30 is affected, and because no TLS is used, a passive sniffer or an attacker who establishes an interception position (for example via ARP spoofing or a rogue access point) can harvest passwords and session tokens and then hijack sessions to issue device commands. Exploitation requires only an adjacent-network position and no authentication on the module itself; there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, but the confidentiality impact is high and the flaw is trivially exploitable wherever untrusted clients, guest Wi-Fi, or shared VLANs can reach the device. Vendor-released patch: version 3.0.30.
mH-DEVELOPER smart home modules running firmware before 3.0.30 start up without loading any firewall rules, leaving SSH, HTTP, WebSocket, and Node-RED listening on the LAN with no access control, so any client on the same network segment can reach every service unauthenticated (CVSS 4.0 5.3; CVSS 3.1 AV:A/AC:L/PR:N/UI:N, low confidentiality and integrity impact). Exploitation requires network adjacency - the module is not reachable from the internet unless another device bridges access - and meaningful device takeover typically depends on chaining one of the sibling vulnerabilities covered by the same CERT-PL advisory. No public exploit identified at time of analysis, and the issue is a design/hygiene weakness (CWE-923) rather than a memory-corruption or code-execution flaw; the vendor fixed it in version 3.0.30.
Missing authentication in the mH-DEVELOPER smart home module lets any device on the same LAN query its HTTP API and WebSocket endpoints and issue raw control commands to building-automation hardware, because the authorization middleware never verifies tokens. The flaw maps to CWE-306 (Missing Authentication for Critical Function) and affects every release prior to 3.0.30, the version in which the vendor fixed it; no public exploit code has been identified at time of analysis. The vendor CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N, base 6.4) and our independent CVSS 3.1 assessment agree that exploitation is trivial but gated by network adjacency: the attacker must already be on the same local or building network, and no authentication or user interaction is required beyond that.
Man-in-the-middle attacks against F&F Filipowski mH-DEVELOPER smart home modules running firmware before 3.0.30 are possible because every unit ships with the same hard-coded SSH host keys and performs no per-device key generation, so an attacker who extracts those keys from a firmware image can stand up a rogue SSH server that clients accept without any warning. Exploitation is unauthenticated (PR:N) but requires two prerequisites in combination: possession of the static keys and an on-path position between an SSH client and the device (reflected in the CVSS 4.0 AT:P requirement, and in our assessed CVSS:3.1 AC:H), which keeps this a moderate, on-path-dependent flaw rather than a mass-exploitable one; no public exploit code or confirmed active exploitation was identified at time of analysis. Impact is limited to credential and data interception (VC:L/VI:L) with no availability effect, and devices updated to 3.0.30 are not vulnerable.
Hardcoded root SSH access in F&F Filipowski's mH-DEVELOPER smart home module allows anyone who obtains the matching private key to log in as root over the always-running SSH daemon and fully compromise the device. The key is baked into /root/.ssh/authorized_keys, cannot be deleted without remounting the filesystem, and survives a factory reset, so the exposure persists until firmware 3.0.30 is installed. Attack surface is adjacent/local rather than Internet-wide (CVSS 4.0 7.7, AV:A/AC:H) and the private key is not published in the available sources, which is the main practical barrier; no public exploit code or confirmed active exploitation was identified at time of analysis. Vendor-released patch: 3.0.30.
Denial of service in F&F Filipowski mH-DEVELOPER smart home modules running versions prior to 3.0.30, where the Node.js-based fh-node service accepts JSON and URL-encoded bodies up to 250 MB through the Express bodyParser, allowing a LAN-adjacent attacker to exhaust device RAM and crash the process with out-of-memory conditions. The vendor's CVSS 4.0 vector rates this 5.9 (medium, AV:A/AC:L/AT:P/PR:L) and is availability-only with no confidentiality or integrity impact; successfully triggering the crash is probabilistic because it depends on the device's instantaneous memory usage, which the attacker does not fully control, hence the AT:P rating. Although the vector nominally requires privileges (PR:L), the accompanying assessment notes that sibling flaw CVE-2026-82930 allows all endpoints to be queried without authentication, so any LAN user can reach the vulnerable body-parsing path in practice. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; exploitation is bounded to adjacent-network reach rather than the internet. Vendor-released patch: 3.0.30.
The F&F Filipowski mH-DEVELOPER smart home module ships production firmware built on end-of-life Debian 8 and Node.js 17.0.1, both of which are past their support lifecycles and carry publicly documented, permanently unpatched vulnerabilities. Rather than containing one discrete exploitable flaw, the product is exposed because it bundles obsolete, unsupported third-party components (CWE-1104); an attacker who can reach and correctly trigger one of the known component CVEs in this firmware could achieve arbitrary code execution, data disclosure, or denial of service, and the network-reachable services require no authentication (CVSS vector signals PR:N). No public exploit identified at time of analysis, and no KEV listing, so this is best treated as a software-composition hygiene finding whose real-world risk is contingent on how exposed the device's services are; F&F addressed the issue in firmware 3.0.30.
Cleartext transmission of credentials, authentication tokens, and device commands in the mH-DEVELOPER smart home module (F&F Filipowski) exposes every web interface and API session to interception by anyone sharing the same local network segment. Every version prior to 3.0.30 is affected, and because no TLS is used, a passive sniffer or an attacker who establishes an interception position (for example via ARP spoofing or a rogue access point) can harvest passwords and session tokens and then hijack sessions to issue device commands. Exploitation requires only an adjacent-network position and no authentication on the module itself; there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, but the confidentiality impact is high and the flaw is trivially exploitable wherever untrusted clients, guest Wi-Fi, or shared VLANs can reach the device. Vendor-released patch: version 3.0.30.
mH-DEVELOPER smart home modules running firmware before 3.0.30 start up without loading any firewall rules, leaving SSH, HTTP, WebSocket, and Node-RED listening on the LAN with no access control, so any client on the same network segment can reach every service unauthenticated (CVSS 4.0 5.3; CVSS 3.1 AV:A/AC:L/PR:N/UI:N, low confidentiality and integrity impact). Exploitation requires network adjacency - the module is not reachable from the internet unless another device bridges access - and meaningful device takeover typically depends on chaining one of the sibling vulnerabilities covered by the same CERT-PL advisory. No public exploit identified at time of analysis, and the issue is a design/hygiene weakness (CWE-923) rather than a memory-corruption or code-execution flaw; the vendor fixed it in version 3.0.30.
Missing authentication in the mH-DEVELOPER smart home module lets any device on the same LAN query its HTTP API and WebSocket endpoints and issue raw control commands to building-automation hardware, because the authorization middleware never verifies tokens. The flaw maps to CWE-306 (Missing Authentication for Critical Function) and affects every release prior to 3.0.30, the version in which the vendor fixed it; no public exploit code has been identified at time of analysis. The vendor CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N, base 6.4) and our independent CVSS 3.1 assessment agree that exploitation is trivial but gated by network adjacency: the attacker must already be on the same local or building network, and no authentication or user interaction is required beyond that.
Man-in-the-middle attacks against F&F Filipowski mH-DEVELOPER smart home modules running firmware before 3.0.30 are possible because every unit ships with the same hard-coded SSH host keys and performs no per-device key generation, so an attacker who extracts those keys from a firmware image can stand up a rogue SSH server that clients accept without any warning. Exploitation is unauthenticated (PR:N) but requires two prerequisites in combination: possession of the static keys and an on-path position between an SSH client and the device (reflected in the CVSS 4.0 AT:P requirement, and in our assessed CVSS:3.1 AC:H), which keeps this a moderate, on-path-dependent flaw rather than a mass-exploitable one; no public exploit code or confirmed active exploitation was identified at time of analysis. Impact is limited to credential and data interception (VC:L/VI:L) with no availability effect, and devices updated to 3.0.30 are not vulnerable.