CVE-2026-82929CWE-321

CVE-2026-82929

published September 28, 2026

CVSS
6.3
EPSS
0%
Percentile
14.1
In the wild
Unconfirmed
What it is

mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential interception.

This issue was fixed in version 3.0.30

The record
Technical detail
CVSS
6.3 · NONE
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00238 · 14.1th percentile
Weakness
CWE-321 · Use of Hard-coded Cryptographic Key
Published
2026-09-28T17:17Z
References (2)
https://cert.pl/posts/2026/09/CVE-2026-82928/ · [email protected]https://www.fif.com.pl/pl/strona-glowna/1367-mh-developer.html · [email protected]
EPSS history
Timeline
  • 30 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 28 SEP 12:11Z
    Use of Shared Cryptographic Key in mH-DEVELOPER
    cvelistv5