CVE-2026-82933

CVE-2026-82933

published September 28, 2026

CVSS
6.0
EPSS
0%
Percentile
10.1
In the wild
Unconfirmed
What it is

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions.

This issue was fixed in version 3.0.30

The record
Technical detail
CVSS
6.0 · NONE
CVSS v4.0
6.0 · CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00206 · 10.1th percentile
Published
2026-09-28T17:17Z
References (2)
https://cert.pl/posts/2026/09/CVE-2026-82928/ · [email protected]https://www.fif.com.pl/pl/strona-glowna/1367-mh-developer.html · [email protected]
EPSS history
Timeline
  • 30 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 28 SEP 12:12Z
    Cleartext Transmission of Sensitive Information in mH-DEVELOPER
    cvelistv5