Read the docs
TI-2026-57216 Aliases CVE-2026-82933GHSA-vrv2-qxr4-vjpx

Cleartext Transmission of Sensitive Information in mH-DEVELOPER

Priority LOW 26CWE-1428Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This issue was fixed in version 3.0.30

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00206 10th percentileScored 2026-11-07
Fix Fixed mH-DEVELOPER (F&F Filipowski): 3.0.30

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
F&F FilipowskimH-DEVELOPERbefore 3.0.303.0.30Patch availableCNA
  • mH-DEVELOPER VendorF&F Filipowski Affected before 3.0.30 Fixed in 3.0.30 Patch available CNA

Remediation

  • Fix · CNA mH-DEVELOPER (F&F Filipowski) Fixed in 3.0.30

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    F&F Filipowski mH-DEVELOPER 3.0.30

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-57217 Use of End-of-Life components in mH-DEVELOPERPriority LOW 37
    • TI-2026-57212 Undocumented access path in mH-DEVELOPERPriority LOW 35
    • TI-2026-57214 Missing Authentication in mH-DEVELOPERPriority LOW 28
    Show all 7 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-82933
  2. 2026-10-03 Alias added: GHSA-vrv2-qxr4-vjpx

References

Advisory 1

Other 1

  • TI-2026-57217 Use of End-of-Life components in mH-DEVELOPER CVSS 4.0MEDIUM 6.9
  • TI-2026-57212 Undocumented access path in mH-DEVELOPER CVSS 4.0HIGH 7.7
  • TI-2026-57214 Missing Authentication in mH-DEVELOPER CVSS 4.0MEDIUM 6.4
  • TI-2026-57213 Use of Shared Cryptographic Key in mH-DEVELOPER CVSS 4.0MEDIUM 6.3
  • TI-2026-57218 Denial of Service in mH-DEVELOPER CVSS 4.0MEDIUM 5.9
  • TI-2026-57215 Missing Firewall Configuration in mH-DEVELOPER CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences