Critical Unauthenticated RCE in MajorDoMo Exposes IoT Management Servers

A critical vulnerability in the MajorDoMo home automation platform, tracked as CVE-2026-27174, allows unauthenticated remote code execution on internet-facing servers. The flaw stems from improper authentication handling in /admin.php, where requests continue to be processed after a redirect, combined with unsafe use of PHP eval() on attacker-controlled input in an internal AJAX console/debugging component. Researchers reported that a single crafted HTTP GET request can reach the internal handler and execute arbitrary PHP code without valid credentials.

Successful exploitation can give attackers full server compromise, including the ability to run system commands, read sensitive files, steal credentials, and deploy persistent web shells. Because MajorDoMo is often used to manage cameras, sensors, locks, and other building or home automation systems, a breach can also expose connected IoT environments and support lateral movement into internal networks. Public detection content, including a Nuclei template, is already available, raising the risk of rapid exploitation, and defenders have been urged to apply the vendor patch, restrict admin access to trusted networks, place the interface behind a VPN or authenticated reverse proxy, disable the console feature where possible, audit logs, and rotate secrets.