CVE-2026-82928
High
Description
mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected device, resulting in full system compromise. The key cannot be removed without remounting the file system and survives a factory reset. Vendor notes that this functionality was used only for service purposes. This issue was fixed in version 3.0.30
SeverityHigh
CVSS7.7
Exploit probability—
ProductmH-DEVELOPER
PublishedSep 28, 2026
First seenSep 28, 2026
Weakness typeCWE-1242CWE-1242
How to fix
Update
- F&F Filipowski mH-DEVELOPER3.0.30 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| F&F Filipowski mH-DEVELOPER | v < 3.0.30 | 3.0.30 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.