CVE-2026-82935: Use of End-of-Life components in mH-DEVELOPER

Published Sep 28, 2026

Updated

mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. This exposes the device to publicly known vulnerabilities that will not receive security patches. An attacker could exploit these known flaws to execute arbitrary code, access sensitive data, or cause a denial of service on the device. Vulnerable components were updated or hardened, if update was not possible in version 3.0.30

Affected Software

2 affected components

Debian Debian=8

Node.js Node.js=17.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade mH-DEVELOPER to a version that resolves this vulnerability.
Fixed in 3.0.30

Event History

Sep 28, 2026

CVE Published

via MITRE·12:12 PM

Data Sourced

via MITRE·12:12 PM

DescriptionWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which firmware version addresses the unsupported Debian and Node.js components?

The vulnerable components were updated or hardened in version 3.0.30 where an update was not possible.

What is the practical impact of leaving an affected device unpatched?

Known vulnerabilities in the unsupported Debian 8 and Node.js v17.0.1 components may allow an attacker to execute arbitrary code, access sensitive data, or cause denial of service on the device.