CVE-2026-82930— Missing Authentication in mH-DEVELOPER
Quick assessment
Affected
F&F Filipowski mH-DEVELOPER
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
mH-DEVELOPER 智能家居模块在其授权中间件中未验证令牌，导致所有 HTTP API 和 WebSocket 端点均可在未进行身份验证的情况下访问。局域网（LAN）中的未认证攻击者可查询这些端点，获取系统信息，并发送原始控制指令以操纵楼宇自动化设备。 该问题已在版本 3.0.30 中修复。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1078.004 · Cloud Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82930
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Missing Authentication in mH-DEVELOPER
Source: CVE Program / CVE List V5
Vulnerability Description
mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to manipulate building automation devices.
This issue was fixed in version 3.0.30
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| F&F Filipowski | mH-DEVELOPER | 0 ~ 3.0.30 | - |
|
II. Public POCs for CVE-2026-82930
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82930
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-82930 (1)
-
Podatności w urządzeniach F&F Filipowski mH-DEVELOPER third-party-advisory
Other References for CVE-2026-82930 (1)
Same Patch Batch · F&F Filipowski · 2026-09-28 · 7 CVEs total
| CVE-2026-82928 | 7.7 HIGH | Undocumented access path in mH-DEVELOPER |
| CVE-2026-82935 | 6.9 MEDIUM | Use of End-of-Life components in mH-DEVELOPER |
| CVE-2026-82929 | 6.3 MEDIUM | Use of Shared Cryptographic Key in mH-DEVELOPER |
| CVE-2026-82933 | 6.0 MEDIUM | Cleartext Transmission of Sensitive Information in mH-DEVELOPER |
| CVE-2026-82936 | 5.9 MEDIUM | Denial of Service in mH-DEVELOPER |
| CVE-2026-82932 | 5.3 MEDIUM | Missing Firewall Configuration in mH-DEVELOPER |
IV. Related Vulnerabilities
Same product: mH-DEVELOPER
-
CVE-2026-82936
Denial of Service in mH-DEVELOPER -
CVE-2026-82935
Use of End-of-Life components in mH-DEVELOPER -
CVE-2026-82933
Cleartext Transmission of Sensitive Information in mH-DEVELO -
CVE-2026-82932
Missing Firewall Configuration in mH-DEVELOPER -
CVE-2026-82929
Use of Shared Cryptographic Key in mH-DEVELOPER
Same vendor: F&F Filipowski
-
CVE-2026-82936
Denial of Service in mH-DEVELOPER -
CVE-2026-82935
Use of End-of-Life components in mH-DEVELOPER -
CVE-2026-82933
Cleartext Transmission of Sensitive Information in mH-DEVELO -
CVE-2026-82932
Missing Firewall Configuration in mH-DEVELOPER -
CVE-2026-82929
Use of Shared Cryptographic Key in mH-DEVELOPER
Same weakness: CWE-306
-
CVE-2026-93539
Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook -
CVE-2026-52748
Missing authentication for backup functionality in Kaon AR21 -
CVE-2026-82383
Apache Roller: Anonymous setup action allows frontpage confi -
CVE-2026-101004
notionnext-org NotionNext Authentication Guard cache.js clea -
CVE-2026-100903
ООО НПО Ритм GEOritm REST API obj-groups missing authenticat
V. Comments for CVE-2026-82930
No comments yet