Vulnerabilities in F&F Filipowski mH-DEVELOPER devices

CERT Polska disclosed seven vulnerabilities in F&F Filipowski mH-DEVELOPER smart home modules (fixed in 3.0.30) including a hardcoded SSH public key that grants root access, identical SSH host keys enabling MitM, missing authentication on HTTP/WebSocket endpoints allowing unauthenticated control, lack of firewall rules exposing services on the LAN, plaintext HTTP traffic leaking credentials, use of unsupported/outdated OS and runtimes, and an HTTP body-size related DoS — collectively enabling full device compromise or service disruption on affected units.