CVE-2026-82932
Missing Firewall Configuration in mH-DEVELOPER
F&F Filipowski mH-DEVELOPER
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.0.30mH-DEVELOPERCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service.
This issue was fixed in version 3.0.30
Text from CVE List
Affected versions 1
- mH-DEVELOPERaffected: all versions before 3.0.30CVE List