CVE-2026-82933

MediumCVSS 6.0/10Last modified Sep 28, 2026

Description

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions.

This issue was fixed in version 3.0.30

Metrics

CVSS 4.0 6.0/10CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected software

No affected versions have been published.

Timeline

Published
Sep 28, 2026
Last modified
Sep 28, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-829356.9mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. This CVE-2026-829365.9mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configCVE-2026-829427.5A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) CVE-2026-829436.5SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device can send messages that cause the master to read data from mCVE-2026-829448.8SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffersCVE-2026-829456.5SOEM version 2.0.0 and earlier contains a vulnerability during device configuration where a malicious device can cause memory corruption. ThCVE-2026-829466.5SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the master system. When the software receives an CVE-2026-829477.1SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read dCVE-2026-82956.9An integer overflow vulnerability in the simdjson document-builder API allows incorrect buffer size calculations in "string_builder::escape_CVE-2026-829535.3NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to cCVE-2026-829549.9A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath of the file packages/server/sCVE-2026-829559.0In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Ga