CVE-2026-82930CWE-306

CVE-2026-82930

published September 28, 2026

CVSS
6.4
EPSS
0%
Percentile
11.3
In the wild
Unconfirmed
What it is

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to manipulate building automation devices.

This issue was fixed in version 3.0.30

The record
Technical detail
CVSS
6.4 · NONE
CVSS v4.0
6.4 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:H/SA:H
EPSS
0.00215 · 11.3th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-09-28T17:17Z
References (2)
https://cert.pl/posts/2026/09/CVE-2026-82928/ · [email protected]https://www.fif.com.pl/pl/strona-glowna/1367-mh-developer.html · [email protected]
EPSS history
Timeline
  • 30 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 28 SEP 12:11Z
    Missing Authentication in mH-DEVELOPER
    cvelistv5