Vulnerability · Published Sep 28, 2026 · Assigned by CERT-PL

CVE-2026-82928Undocumented access path in mH-DEVELOPER

High 7.7

In plain English

A high-severity security flaw in mH-DEVELOPER from F&F Filipowski. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 4.0)7.7High

Exploit odds (30 days)0.2%top 92.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected device, resulting in full system compromise. The key cannot be removed without remounting the file system and survives a factory reset. Vendor notes that this functionality was used only for service purposes. This issue was fixed in version 3.0.30

Affected products (as reported)

Vendor	Product	Versions
F&F Filipowski	mH-DEVELOPER	0 – before 3.0.30

Weakness: CWE-1242 · Vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://cert.pl/posts/2026/09/CVE-2026-82928/ third-party-advisory
https://www.fif.com.pl/pl/strona-glowna/1367-mh-developer.html product