# CVE-2026-82930: F&F Filipowski mH-DEVELOPER missing authentication in API

Source: https://junglewise.ai/threats/cve-2026-82930-mh-developer-smart-home-module-does-not-verify-tokens-in-its  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-82930 · Severity: info · Published 2026-09-28

The mH-DEVELOPER is a smart home control module that manages heating, lighting, and electrical outlets in buildings. An attacker on the same local network can access all HTTP API and WebSocket endpoints without a password, allowing them to query system information and send commands to control building automation devices like thermostats and lights.

Technologies: [F&F Filipowski mH-DEVELOPER](https://junglewise.ai/threats/technologies/mh-developer). Vendors: [F&F Filipowski](https://junglewise.ai/threats/vendors/f-f-filipowski).

## Quick answers

**Is CVE-2026-82930 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82930 being exploited in the wild.

**How severe is CVE-2026-82930?** Informational severity, published 28 September 2026.

**Which products and versions are affected?** F&F Filipowski mH-DEVELOPER below 3.0.30.

**Is there a fix for CVE-2026-82930?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82930 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-82930?** Check whether you run F&F Filipowski mH-DEVELOPER at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The authorization middleware in the HTTP API and WebSocket endpoints fails to validate authentication tokens, allowing unauthenticated access from the local network. An attacker with LAN access can directly query these endpoints to extract system information and issue raw control commands to manipulate building automation devices. The vulnerability was patched in version 3.0.30.

## Affected products

- F&F Filipowski mH-DEVELOPER below 3.0.30

## Timeline

- 2026-09-28: disclosed

## References

- [https://cert.pl/posts/2026/09/CVE-2026-82928/](https://cert.pl/posts/2026/09/CVE-2026-82928/)
- [https://www.fif.com.pl/pl/strona-glowna/1367-mh-developer.html](https://www.fif.com.pl/pl/strona-glowna/1367-mh-developer.html)

## Related threats

- [F&F Filipowski mH-DEVELOPER denial of service via uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-82936-mh-developer-smart-home-module-is-vulnerable-to-denial-of-service)
- [F&F Filipowski mH-DEVELOPER use of unmaintained third-party components](https://junglewise.ai/threats/cve-2026-82935-mh-developer-smart-home-module-ships-with-an-end-of-life)
- [F&F Filipowski mH-DEVELOPER cleartext HTTP transmission](https://junglewise.ai/threats/cve-2026-82933-mh-developer-smart-home-module-sends-its-web-interface-and-api)
- [F&F Filipowski mH-DEVELOPER missing firewall initialization](https://junglewise.ai/threats/cve-2026-82932-mh-developer-smart-home-module-does-not-load-any-firewall-rules)
- [F&F Filipowski mH-DEVELOPER hard-coded SSH host keys](https://junglewise.ai/threats/cve-2026-82929-mh-developer-smart-home-module-uses-the-same-hard-coded-ssh-host)