CVE-2026-82933: Cleartext Transmission of Sensitive Information in mH-DEVELOPER

Severity: medium (CVSS 6.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-28 · updated 2026-09-28
Weakness: CWE-1428

Description

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This issue was fixed in version 3.0.30

Affected products

F&F Filipowski mH-DEVELOPER: before 3.0.30 — fixed in 3.0.30

How to fix

Upgrade to a fixed version: F&F Filipowski mH-DEVELOPER 3.0.30. Check the vendor advisory for mitigations.

References

https://cert.pl/posts/2026/09/CVE-2026-82928/
https://www.fif.com.pl/pl/strona-glowna/1367-mh-developer.html

Get alerted when CVE-2026-82933 or the next vulnerability affects your stack