Vulnerability · Published Sep 28, 2026 · Assigned by CERT-PL

CVE-2026-82929Use of Shared Cryptographic Key in mH-DEVELOPER

Medium 6.3

In plain English

A medium-severity security flaw in mH-DEVELOPER from F&F Filipowski. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.2%top 85.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential interception. This issue was fixed in version 3.0.30

Affected products (as reported)

Vendor	Product	Versions
F&F Filipowski	mH-DEVELOPER	0 – before 3.0.30

Weakness: CWE-321 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://cert.pl/posts/2026/09/CVE-2026-82928/ third-party-advisory
https://www.fif.com.pl/pl/strona-glowna/1367-mh-developer.html product