Majordomo
CVE-2026-27175
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to rc/index.php
-
DeliveryInject OS command via unsanitized $param variable
-
ExploitCommand queued in database without sanitization
-
ExecutionAccess web-exposed cycle_execs.php
-
ImpactExecute queued command via exec()
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions — remote unauthenticated exploitation against default MajorDoMo installations with web-accessible rc/index.php and cycle_execs.php endpoints. |
| Impact | CVSS 9.8, EPSS 41.7%. Second high-EPSS vulnerability in MajorDoMo. Actively targeted by botnets. |
| Exploit ScenarioDerived | Automated scanner discovers MajorDoMo, injects commands through rc/index.php, deploys cryptominer or botnet agent on the home automation server. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Unauthenticated OS command injection in MajorDoMo via rc/index.php. EPSS 41.7% — the $param variable is passed unsanitized to shell commands. PoC available.
Earlier versions of this analysis (1)
Command injection in MajorDoMo rc/index.php.
RemediationAI
Implement authentication on all endpoints. Sanitize shell command parameters.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 OS command injection through $param variable in rc/index.php. No authentication required.
Know when Majordomo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg(). The command is inserted into a database queue by safe_exec(), which performs no sanitization. The cycle_execs.php script, which is web-accessible without authentication, retrieves queued commands and passes them directly to exec(). An attacker can exploit a race condition by first triggering cycle_execs.php (which purges the queue and enters a polling loop), then injecting a malicious command via the rc endpoint while the worker is polling. The injected shell metacharacters expand inside double quotes, achieving remote code execution within one second.
Articles & Coverage 1
Executive ViewAI
MajorDoMo installations are vulnerable to complete system compromise through unauthenticated remote code execution with a 41.7% exploitation probability. Any organization running this software faces immediate risk of data breach, operational disruption, and infrastructure takeover without authentication requirements.
Implement Web Application Firewall rules to block requests to rc/index.php with suspicious parameters; restrict network access to MajorDoMo via IP whitelisting and firewall rules; disable the rc module entirely if functionality permits; place MajorDoMo behind a VPN or internal network only; disable unauthenticated access by implementing reverse proxy authentication; monitor logs for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
MajorDoMo home automation platform is vulnerable to unauthenticated remote code execution through supply chain compromis
MajorDoMo home automation platform allows unauthenticated remote code execution through the admin panel's PHP console. A
MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. Rated
Unauthenticated SQL injection in MajorDoMo's commands module allows remote attackers to extract database contents includ
Unauthenticated module deletion in Majordomo's market module allows remote attackers to completely disable installations
MajorDomo's shoutbox feature is vulnerable to stored XSS due to unsanitized user input in the /objects/?method= endpoint
MajorDoMo's unauthenticated /objects/?op=set endpoint fails to sanitize property values, allowing remote attackers to in
Reflected XSS in MajorDoMo's command.php allows remote attackers to inject arbitrary JavaScript through an unsanitized q
Exploit-DB