Cyber Posture

CVE-2026-27174

CriticalPublic PoC

Published: 18 February 2026

Published
18 February 2026
Modified
20 February 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.8541 99.4th percentile
Risk Priority 71 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2026-27174 is a critical remote code execution vulnerability in MajorDoMo (also known as Major Domestic Module), an open-source home automation platform. The flaw affects the admin panel's PHP console feature due to an include order bug in modules/panel.class.php, which allows execution to proceed past a redirect() call lacking an exit statement. This permits unauthenticated requests to reach the ajax handler in inc_panel_ajax.php, where user-supplied input from GET parameters is passed directly to eval() without authentication checks, exacerbated by the use of register_globals.

Any unauthenticated remote attacker can exploit this vulnerability by sending a crafted GET request to /admin.php with the ajax_panel, op, and command parameters containing arbitrary PHP code. Successful exploitation results in full remote code execution on the affected server, providing complete control over the system. The vulnerability has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified under CWE-94 (Improper Control of Generation of Code).

Advisories and patches are available via referenced sources, including a detailed technical post at https://chocapikk.com/posts/2026/majordomo-revisited/, a fix pull request at https://github.com/sergejey/majordomo/pull/1177, and a VulnCheck advisory at https://www.vulncheck.com/advisories/majordomo-unauthenticated-remote-code-execution-via-admin-console-eval. Security practitioners should consult these for specific mitigation guidance, such as applying the upstream patch.

Details

CWE(s)
CWE-94

Affected Products

mjdm
majordomo
all versions

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability allows unauthenticated remote code execution via a public-facing web application (admin panel), directly mapping to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References