18794 matches found
CVE-2026-82932 Missing Firewall Configuration in mH-DEVELOPER
mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service. This issue was fixed in...
CVE-2026-82929 Use of Shared Cryptographic Key in mH-DEVELOPER
mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential...
CVE-2026-82929
The mH-DEVELOPER smart home module is vulnerable because it uses identical hard-coded SSH host keys across all devices instead of generating unique per-device keys. An attacker capable of extracting these keys from the firmware can deploy a rogue SSH server that clients will trust automatically. ...
EUVD-2026-88229
mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential...
CVE-2026-82929 Use of Shared Cryptographic Key in mH-DEVELOPER
mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential...
EUVD-2026-88228
mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorizedkeys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected devic...
CVE-2026-82928 Undocumented access path in mH-DEVELOPER
mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorizedkeys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected devic...
CVE-2026-82928 Undocumented access path in mH-DEVELOPER
mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorizedkeys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected devic...
CVE-2026-82929: Use of Hard-coded Cryptographic Key
mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential...
PT-2026-99863
mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential...
The vulnerability of the golang.org/x/crypto/ssh library for the Go programming language, which allows attackers to escalate their privileges.
The vulnerability of the golang.org/x/crypto/ssh library for the Go programming language is related to improper storage of permissions. Exploiting this vulnerability can allow an attacker to enhance their privileges remotely...
The vulnerability of the golang.org/x/crypto/ssh library for the Go programming language, which allows attackers to compromise the accessibility of protected information.
The vulnerability of the golang.org/x/crypto/ssh library for the Go programming language is related to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker to influence the accessibility of protected information...
CVE-2026-82932: Improper Restriction of Communication Channel to Intended Endpoints
mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service. This issue was fixed in...
PT-2026-99865
mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service. This issue was fixed in...
CVE-2026-82928: Inclusion of Undocumented Features or Chicken Bits
mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorizedkeys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected devic...
Important: curl
Issue Overview: When a user invokes curl using a schemeless URL combined with --proto-default sftp or scp, a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like...
PT-2026-99862
Name of the Vulnerable Software and Affected Versions mH-DEVELOPER smart home module versions prior to 3.0.30 Description The software contains a hardcoded SSH public key located in the /root/.ssh/authorized keys file, which functions as a backdoor. The SSH daemon is configured to start...
Exploit for Improper Enforcement of Behavioral Workflow in Mikrotik Routeros
CVE-2026-67279 + CVE-2026-8...
Exploit for Missing Authentication for Critical Function in Erlang Erlang\/Otp
Reproduce-CVE-2025-32433 Reproduction, analysis, and patch st...
MGASA-2026-0457 Updated erlang package fixes security vulnerabilities
SSH SFTP server denial of service via extended channel data infinite loop. CVE-2026-54886 Plaintext APPLICATIONDATA injected during TLS handshake delivered to client application post-handshake in ssl. CVE-2026-54891 Plug: quadratic-time decoding of nested query/body parameters enables denial of...