Krzysztof Chudzik

**Nome do Software Vulnerável e Versões Afetadas** mH-DEVELOPER smart home module versões anteriores a 3.0.30 **Description** O software contém uma chave pública SSH hardcoded localizada no arquivo `/root/.ssh/authorized keys`, que funciona como um backdoor. O daemon SSH está configurado para iniciar automaticamente e permite o login de root via autenticação de chave. Um invasor que possua a chave privada correspondente pode obter um shell de root, resultando no comprometimento total do sistema. Esta chave persiste após a redefinição de fábrica e não pode ser excluída sem a remontagem do sistema de arquivos. O fornecedor afirmou que este recurso foi destinado exclusivamente para fins de serviço. **Recommendations** Atualize para a versão 3.0.30.

mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential interception. This issue was fixed in version 3.0.30

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to manipulate building automation devices. This issue was fixed in version 3.0.30

mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service. This issue was fixed in version 3.0.30

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This issue was fixed in version 3.0.30

**Nome do Software Vulnerável e Versões Afetadas** mH-DEVELOPER versões anteriores a 3.0.30 **Description** O módulo de casa inteligente utiliza o sistema operacional Debian 8 e o runtime Node.js v17.0.1, ambos em fim de vida e sem suporte, em seu firmware de produção. A dependência desses componentes obsoletos expõe o dispositivo a falhas de segurança conhecidas que não recebem mais correções, permitindo potencialmente que um invasor execute código arbitrário, acesse dados sensíveis ou cause a negação de serviço. **Recommendations** Atualize para a versão 3.0.30.

mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with a 250 MB limit for JSON and URL-encoded request bodies. An authenticated attacker on the LAN can send large request bodies that exhausts buffers in RAM, causing out-of-memory conditions and crashing the fh-node process, resulting in denial of service. The successful attack depends on the current memory usage of the device which is not under full control of the attacker. Critically, due to CVE-2026-82930 all endpoints can be queried unauthenticated, so any user on LAN can perform this attack. This issue was fixed in version 3.0.30