CVE-2026-82933
Cleartext Transmission of Sensitive Information in mH-DEVELOPER
F&F Filipowski mH-DEVELOPER
CVSS
6.0MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.0.30mH-DEVELOPERCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions.
This issue was fixed in version 3.0.30
Text from CVE List
Affected versions 1
- mH-DEVELOPERaffected: all versions before 3.0.30CVE List