Loading story…
CERT Polska disclosed seven vulnerabilities in F&F Filipowski mH-DEVELOPER building-automation modules, affecting versions before 3.0.30: CVE-2026-82928, CVE-2026-82929, CVE-2026-82930, CVE-2026-82932, CVE-2026-82933, CVE-2026-82935, and CVE-2026-82936. The issues include a hardcoded SSH authorized key enabling potential root compromise, shared SSH host keys enabling man-in-the-middle attacks, and absent API and WebSocket authentication that lets an unauthenticated party on the local network control building-automation functions.
Additional weaknesses leave services exposed on the LAN because firewall rules are not loaded, send web and API traffic through unencrypted HTTP, and use end-of-life Debian 8 and Node.js 17.0.1 components. Oversized requests can also exhaust resources and crash the fh-node process; the missing API authentication makes this denial-of-service condition effectively unauthenticated. F&F Filipowski remediated the reported vulnerabilities in mH-DEVELOPER version 3.0.30, and affected organizations should upgrade promptly and restrict device network access until patched.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
F&F Filipowski fixed all seven reported vulnerabilities in mH-DEVELOPER version 3.0.30.
CERT Polska coordinated disclosure of seven vulnerabilities in F&F Filipowski mH-DEVELOPER smart-home modules affecting versions before 3.0.30. The flaws include root access through a hardcoded SSH key, shared SSH host keys, missing API authentication, LAN service exposure, cleartext HTTP, unsupported components, and a denial-of-service condition.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Pandora FMS disclosed two high-severity vulnerabilities affecting versions `777` through `800`, including **CVE-2026-30804**, an unrestricted file upload flaw in the Extension Uploader that can allow remote code execution, and **CVE-2026-30811**, a missing authorization issue in a configuration AJAX endpoint that can expose sensitive information. The file upload bug is classified as `CWE-434`, indicating that attackers may be able to upload dangerous file types and execute code on vulnerable systems. The second flaw, mapped to `CWE-276`, stems from improper authorization controls and could let unauthorized users access configuration data through the affected endpoint. Both CVE records were published with CVSS v4.0 vectors and vendor references from Pandora FMS, indicating that the issues were formally acknowledged by the vendor and impact the same product range.
Jun 29, 2026
**CISA** published an ICS advisory warning that **Johnson Controls Frick Controls Quantum HD** (versions **10.22 and earlier**) contains multiple vulnerabilities that can be exploited **before authentication**, enabling **remote code execution (RCE)**, **information leakage**, and potentially **denial of service** in environments where the product is deployed (noted as worldwide, including **Food and Agriculture** critical infrastructure). CISA lists a **CVSS v3.1 base score of 9.1 (Critical)** for the issue set and attributes the root cause across several items to **insufficient input validation** in device parameters. The disclosed CVEs include **CVE-2026-21654** (**OS command injection**, CWE-78) and several **code injection** RCE issues (**CVE-2026-21656**, **CVE-2026-21657**, **CVE-2026-21658**, **CWE-94**) that could allow unexpected actions and system compromise without credentials. **CVE-2026-21659** describes **local file inclusion (LFI)** (CWE-23) leading to **unauthenticated RCE and information disclosure**, explicitly stating an attacker could execute arbitrary code and achieve **full system compromise** on affected devices. The advisory also references an additional CVE (**CVE-2026-21660**) not detailed in the other provided entries, indicating the exposure spans more than the five CVE records included here.
Jun 29, 2026
A critical vulnerability in the MajorDoMo home automation platform, tracked as **`CVE-2026-27174`**, allows unauthenticated remote code execution on internet-facing servers. The flaw stems from improper authentication handling in **`/admin.php`**, where requests continue to be processed after a redirect, combined with unsafe use of PHP **`eval()`** on attacker-controlled input in an internal AJAX console/debugging component. Researchers reported that a single crafted HTTP GET request can reach the internal handler and execute arbitrary PHP code without valid credentials. Successful exploitation can give attackers full server compromise, including the ability to run system commands, read sensitive files, steal credentials, and deploy persistent web shells. Because MajorDoMo is often used to manage cameras, sensors, locks, and other building or home automation systems, a breach can also expose connected IoT environments and support lateral movement into internal networks. Public detection content, including a **Nuclei** template, is already available, raising the risk of rapid exploitation, and defenders have been urged to apply the vendor patch, restrict admin access to trusted networks, place the interface behind a VPN or authenticated reverse proxy, disable the console feature where possible, audit logs, and rotate secrets.
Jun 29, 2026