https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T22:55:16.258115+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-82928 fkie_cve-2026-82928 2026-09-28T22:55:16.316303+00:00

mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected device, resulting in full system compromise. The key cannot be removed without remounting the file system and survives a factory reset. Vendor notes that this functionality was used only for service purposes.

This issue was fixed in version 3.0.30

 https://vulnerability.circl.lu/vuln/ghsa-27f6-7954-3wm7 GHSA-27f6-7954-3wm7 2026-09-28T22:55:16.316511+00:00

mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected device, resulting in full system compromise. The key cannot be removed without remounting the file system and survives a factory reset. Vendor notes that this functionality was used only for service purposes.

This issue was fixed in version 3.0.30