Read the docs
TI-2026-57214 Aliases CVE-2026-82930GHSA-rr4v-3p4h-3928

Missing Authentication in mH-DEVELOPER

Priority LOW 28CWE-306Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to manipulate building automation devices. This issue was fixed in version 3.0.30

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00215 12th percentileScored 2026-11-07
Fix Fixed mH-DEVELOPER (F&F Filipowski): 3.0.30

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
F&F FilipowskimH-DEVELOPERbefore 3.0.303.0.30Patch availableCNA
  • mH-DEVELOPER VendorF&F Filipowski Affected before 3.0.30 Fixed in 3.0.30 Patch available CNA

Remediation

  • Fix · CNA mH-DEVELOPER (F&F Filipowski) Fixed in 3.0.30

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    F&F Filipowski mH-DEVELOPER 3.0.30

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-57217 Use of End-of-Life components in mH-DEVELOPERPriority LOW 37
    • TI-2026-57212 Undocumented access path in mH-DEVELOPERPriority LOW 35
    • TI-2026-57213 Use of Shared Cryptographic Key in mH-DEVELOPERPriority LOW 28
    Show all 7 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-82930
  2. 2026-10-03 Alias added: GHSA-rr4v-3p4h-3928

References

Advisory 1

Other 1

  • TI-2026-57217 Use of End-of-Life components in mH-DEVELOPER CVSS 4.0MEDIUM 6.9
  • TI-2026-57212 Undocumented access path in mH-DEVELOPER CVSS 4.0HIGH 7.7
  • TI-2026-57213 Use of Shared Cryptographic Key in mH-DEVELOPER CVSS 4.0MEDIUM 6.3
  • TI-2026-57218 Denial of Service in mH-DEVELOPER CVSS 4.0MEDIUM 5.9
  • TI-2026-57216 Cleartext Transmission of Sensitive Information in mH-DEVELOPER CVSS 4.0MEDIUM 6.0
  • TI-2026-57215 Missing Firewall Configuration in mH-DEVELOPER CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences