[ Vendor · 7 CVEs ]
F&F Filipowski
CVEs affecting F&F Filipowski published in the last 30 days, plus any F&F Filipowski CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-82936 | 28 Sep 2026 | CVSS 5.9 | F&F Filipowski mH-DEVELOPERmH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with… | |
| CVE-2026-82928 | 28 Sep 2026 | CVSS 7.7 | F&F Filipowski mH-DEVELOPERmH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor. The SSH daemon… | |
| CVE-2026-82929 | 28 Sep 2026 | CVSS 6.3 | F&F Filipowski mH-DEVELOPERmH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts… | |
| CVE-2026-82930 | 28 Sep 2026 | CVSS 6.4 | F&F Filipowski mH-DEVELOPERmH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible… | |
| CVE-2026-82932 | 28 Sep 2026 | CVSS 5.3 | F&F Filipowski mH-DEVELOPERmH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and… | |
| CVE-2026-82933 | 28 Sep 2026 | CVSS 6.0 | F&F Filipowski mH-DEVELOPERmH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands… | |
| CVE-2026-82935 | 28 Sep 2026 | CVSS 6.9 | F&F Filipowski mH-DEVELOPERmH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. This exposes… |