CVE-2026-82935
MediumCVSS 6.9Summary
mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. This exposes the device to publicly known vulnerabilities that will not receive security patches. An attacker could exploit these known flaws to execute arbitrary code, access sensitive data, or cause a denial of service.
Risk Assessment
Lack of support for the used components means known vulnerabilities will remain unpatched, potentially leading to device compromise, data leakage, or service disruption. The risk is high due to public availability of exploits.
Recommendation
Update the software to version 3.0.30, where vulnerable components were updated or hardened. If update is not possible, isolate the device on the network and restrict access.
Other vulnerabilities in mH-DEVELOPER smart home module
See all- CVE-2026-82936Medium
mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with a 250 MB limit for JSON and URL-encoded request bodies, allowing an authenticated LAN attacker to send large request bodies that exhaust RAM buffers, causing out-of-memory conditions and crashing the fh-node process. Due to CVE-2026-82930 all endpoints can be queried unauthenticated, so any LAN user can perform this attack.
- CVE-2026-82933Medium
mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions.
- CVE-2026-82932Medium
mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service.
- CVE-2026-82930Medium
mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated LAN attacker can query these endpoints, access system information, and send raw control commands to manipulate building automation devices.
- CVE-2026-82929Medium
mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential interception.
- CVE-2026-82928High
The mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected device, resulting in full system compromise. The key cannot be removed without remounting the file system and survives a factory reset. Vendor notes that this functionality was used only for service purposes. This issue was fixed in version 3.0.30.
Original NVD description (English source)
mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. This exposes the device to publicly known vulnerabilities that will not receive security patches. An attacker could exploit these known flaws to execute arbitrary code, access sensitive data, or cause a denial of service on the device. Vulnerable components were updated or hardened, if update was not possible in version 3.0.30
Vulnerability data from NVD (NIST) · CISA KEV · EPSS