Read the docs
TI-2026-57217 Aliases CVE-2026-82935GHSA-p2fw-wccq-9qh3

Use of End-of-Life components in mH-DEVELOPER

Priority LOW 37CWE-1104Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. This exposes the device to publicly known vulnerabilities that will not receive security patches. An attacker could exploit these known flaws to execute arbitrary code, access sensitive data, or cause a denial of service on the device. Vulnerable components were updated or hardened, if update was not possible in version 3.0.30

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00368 30th percentileScored 2026-11-07
Fix Fixed mH-DEVELOPER (F&F Filipowski): 3.0.30

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
F&F FilipowskimH-DEVELOPERbefore 3.0.303.0.30Patch availableCNA
  • mH-DEVELOPER VendorF&F Filipowski Affected before 3.0.30 Fixed in 3.0.30 Patch available CNA

Remediation

  • Fix · CNA mH-DEVELOPER (F&F Filipowski) Fixed in 3.0.30

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    F&F Filipowski mH-DEVELOPER 3.0.30

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-57212 Undocumented access path in mH-DEVELOPERPriority LOW 35
    • TI-2026-57214 Missing Authentication in mH-DEVELOPERPriority LOW 28
    • TI-2026-57213 Use of Shared Cryptographic Key in mH-DEVELOPERPriority LOW 28
    Show all 7 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-82935
  2. 2026-10-03 Alias added: GHSA-p2fw-wccq-9qh3

References

Advisory 1

Other 1

  • TI-2026-57212 Undocumented access path in mH-DEVELOPER CVSS 4.0HIGH 7.7
  • TI-2026-57214 Missing Authentication in mH-DEVELOPER CVSS 4.0MEDIUM 6.4
  • TI-2026-57213 Use of Shared Cryptographic Key in mH-DEVELOPER CVSS 4.0MEDIUM 6.3
  • TI-2026-57218 Denial of Service in mH-DEVELOPER CVSS 4.0MEDIUM 5.9
  • TI-2026-57216 Cleartext Transmission of Sensitive Information in mH-DEVELOPER CVSS 4.0MEDIUM 6.0
  • TI-2026-57215 Missing Firewall Configuration in mH-DEVELOPER CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences