CVE-2026-82935
mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime…
- Risk score
- 57/100
- CVSS
- 6.9 v4.0
- Exploit chance (30 days)
- 0.4%
- Published
- 28 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. This exposes the device to publicly known vulnerabilities that will not receive security patches. An attacker could exploit these known flaws to execute arbitrary code, access sensitiv…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.9 medium
- On your watchlist: node.js
References
Original description
mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. This exposes the device to publicly known vulnerabilities that will not receive security patches. An attacker could exploit these known flaws to execute arbitrary code, access sensitive data, or cause a denial of service on the device. Vulnerable components were updated or hardened, if update was not possible in version 3.0.30
Last activity 28 Sep 2026. Patch Forecast updates every hour.