F&F Filipowski mH-DEVELOPER up to 3.0.29 channel accessible

Summaryinfo

A vulnerability was found in F&F Filipowski mH-DEVELOPER up to 3.0.29. It has been rated as critical. Affected is an unknown function. The manipulation leads to channel accessible. This vulnerability is uniquely identified as CVE-2026-82929. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in F&F Filipowski mH-DEVELOPER up to 3.0.29. It has been rated as critical. This issue affects an unknown function. The manipulation with an unknown input leads to a channel accessible vulnerability. Using CWE to declare the problem leads to CWE-300. The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential interception. This issue was fixed in version 3.0.30

It is possible to read the advisory at cert.pl. The identification of this vulnerability is CVE-2026-82929 since 08/31/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1557 according to MITRE ATT&CK.

Upgrading to version 3.0.30 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• F&F Filipowski

Name

• mH-DEVELOPER

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.0.9
• 3.0.10
• 3.0.11
• 3.0.12
• 3.0.13
• 3.0.14
• 3.0.15
• 3.0.16
• 3.0.17
• 3.0.18
• 3.0.19
• 3.0.20
• 3.0.21
• 3.0.22
• 3.0.23
• 3.0.24
• 3.0.25
• 3.0.26
• 3.0.27
• 3.0.28
• 3.0.29

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion