CVE-2026-82928: Undocumented access path in mH-DEVELOPER
mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorizedkeys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected device, resulting in full system compromise. The key cannot be removed without remounting the file system and survives a factory reset. Vendor notes that this functionality was used only for service purposes.
This issue was fixed in version 3.0.30
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mH-DEVELOPERto a version that resolves this vulnerability.Fixed in 3.0.30
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs the private key corresponding to the hardcoded public key. SSH starts automatically and permits root login using key authentication, so possession of that private key provides a root shell.
Are devices exposed without enabling a service manually?
Yes. The SSH daemon starts automatically, and the hardcoded key is present in /root/.ssh/authorized_keys. The described service-access functionality therefore exists on affected devices without removing or replacing the key.
How can I check whether a device has the hardcoded access path?
Inspect /root/.ssh/authorized_keys for the hardcoded public key. The key survives a factory reset, so resetting the device does not establish that the access path has been removed.
What can be done if an immediate update is not possible?
The key cannot be removed unless the file system is remounted. A factory reset will not remove it; the vendor-fixed version is 3.0.30.