Is CVE-2026-82928 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82928 being exploited in the wild.

How severe is CVE-2026-82928?

Informational severity, published 28 September 2026.

Which products and versions are affected?

F&F Filipowski mH-DEVELOPER below 3.0.30.

Is there a fix for CVE-2026-82928?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82928 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-82928?

Check whether you run F&F Filipowski mH-DEVELOPER at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82928: F&F Filipowski mH-DEVELOPER hardcoded SSH public key backdoor

CVE-2026-82928 · Severity: info · Published 2026-09-28

The mH-DEVELOPER smart home control module contains a hardcoded SSH public key in the root account's authorized_keys file, allowing anyone with the matching private key to gain complete administrative control of the device. An attacker can remotely log in as root and compromise the entire system, including all connected heating, lighting, and electrical control functions. This backdoor persists even after a factory reset and cannot be removed without remounting the filesystem.

Technologies: F&F Filipowski mH-DEVELOPER. Vendors: F&F Filipowski.

Quick answers

Is CVE-2026-82928 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82928 being exploited in the wild.
How severe is CVE-2026-82928?: Informational severity, published 28 September 2026.
Which products and versions are affected?: F&F Filipowski mH-DEVELOPER below 3.0.30.
Is there a fix for CVE-2026-82928?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82928 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-82928?: Check whether you run F&F Filipowski mH-DEVELOPER at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability (CWE-321, hardcoded cryptographic key) allows remote attackers to obtain root shell access via SSH key authentication without credentials. The SSH daemon runs automatically with root login enabled, and the hardcoded public key is embedded in the firmware and survives system resets. An attacker with network access to the device can authenticate using the extracted private key and achieve full system compromise.

Affected products

F&F Filipowski mH-DEVELOPER below 3.0.30

Timeline

2026-09-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.