CVE-2026-27174: MajorDoMo RCE Vulnerability

CVE-2026-27174 Overview

MajorDoMo (aka Major Domestic Module) contains a critical unauthenticated remote code execution vulnerability in the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach the ajax handler in inc_panel_ajax.php. The console handler within that file passes user-supplied input from GET parameters (via register_globals) directly to eval() without any authentication check. An attacker can execute arbitrary PHP code by sending a crafted GET request to /admin.php with ajax_panel, op, and command parameters.

Critical Impact

This vulnerability allows unauthenticated attackers to achieve complete system compromise through arbitrary PHP code execution, potentially leading to full server takeover, data theft, and lateral movement within the network.

Affected Products

• MajorDoMo (Major Domestic Module) - Home Automation System
• Installations with publicly accessible admin panels
• Systems using affected versions of modules/panel.class.php and inc_panel_ajax.php

Discovery Timeline

• 2026-02-18 - CVE-2026-27174 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-27174

Vulnerability Analysis

This vulnerability represents a classic case of improper authentication enforcement combined with dangerous code execution primitives. The root issue stems from an include order bug where the authentication check in modules/panel.class.php calls redirect() but fails to immediately terminate script execution with an exit statement. This allows unauthenticated request processing to continue through the logic flow.

Once an attacker bypasses the authentication gate, they can reach the AJAX handler in inc_panel_ajax.php, which contains a console feature designed for administrative debugging. This console handler uses PHP's register_globals functionality to accept user-controlled input from GET parameters, which is then passed directly to eval() for execution.

The combination of authentication bypass and direct eval() execution creates a trivially exploitable attack surface. No authentication tokens, session cookies, or special headers are required—only a properly formatted HTTP GET request to the vulnerable endpoint.

Root Cause

The vulnerability originates from two distinct coding errors that combine to create a critical security flaw:

1. Missing Exit Statement: The authentication check in modules/panel.class.php invokes redirect() for unauthenticated users but fails to call exit or die() afterward. In PHP, redirect() typically only sends HTTP headers and does not halt script execution unless explicitly coded to do so. This allows the remaining code to execute despite the redirect being issued.

2. Unsafe eval() Usage: The console handler in inc_panel_ajax.php passes user-supplied input directly to eval() without sanitization. The use of register_globals means that GET parameters are automatically converted to PHP variables, making exploitation trivial.

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection).

Attack Vector

The attack leverages the network-accessible admin panel interface. An attacker sends a specially crafted GET request to /admin.php containing the following parameters:

• ajax_panel - Triggers the AJAX handler pathway
• op - Specifies the operation to perform (console execution)
• command - Contains the malicious PHP code to execute

The vulnerable code path processes the request as follows: the redirect() call fires but script execution continues, the AJAX handler is invoked, register_globals populates variables from GET parameters, and the command parameter is passed directly to eval(). The attacker's PHP code executes with the privileges of the web server process, typically allowing file system access, database manipulation, and further system compromise.

For technical details on the exploitation mechanism, refer to the Chocapikk Blog Post and the Vulncheck Security Advisory.

Detection Methods for CVE-2026-27174

Indicators of Compromise

• HTTP GET requests to /admin.php containing ajax_panel, op, and command parameters from external IP addresses
• Unusual process spawning from the web server process (e.g., www-data or apache user)
• Unexpected files created in web-accessible directories or temporary folders
• Anomalous outbound network connections from the MajorDoMo server

Detection Strategies

• Configure web application firewalls (WAF) to detect and block requests containing eval(), system(), exec(), or other dangerous PHP functions in the command parameter
• Implement log monitoring for suspicious access patterns to /admin.php with AJAX-related parameters
• Deploy endpoint detection and response (EDR) solutions to identify post-exploitation activities such as reverse shells or unauthorized file modifications
• Use network intrusion detection systems (IDS) to flag unusual traffic patterns from home automation servers

Monitoring Recommendations

• Enable verbose HTTP access logging on the MajorDoMo server and forward logs to a centralized SIEM
• Monitor for privilege escalation attempts and lateral movement originating from the affected system
• Set up alerts for any process execution by the web server user that includes command-line interpreters or network utilities

How to Mitigate CVE-2026-27174

Immediate Actions Required

• Restrict network access to the MajorDoMo admin panel to trusted IP addresses only using firewall rules
• Place the admin interface behind a VPN or reverse proxy with strong authentication
• If not required, disable or remove the PHP console feature entirely
• Audit server logs for signs of prior exploitation

Patch Information

A fix has been submitted via the GitHub Pull Request #1177. Organizations should review and apply this patch immediately or upgrade to a patched version when officially released. The patch addresses the missing exit statement after the redirect() call and implements proper authentication checks for the console feature.

Workarounds

• Implement IP-based access controls to restrict admin panel access to internal networks only
• Deploy a reverse proxy (e.g., nginx) in front of MajorDoMo to enforce authentication before requests reach the application
• Disable register_globals if supported by your PHP configuration (note: register_globals was removed in PHP 5.4.0, so ensure you are running a supported PHP version)
• Monitor and block requests containing dangerous PHP function names in URL parameters

# Example nginx configuration to restrict admin access
location /admin.php {
    # Allow only trusted internal networks
    allow 192.168.1.0/24;
    allow 10.0.0.0/8;
    deny all;
    
    # Additional basic authentication layer
    auth_basic "Restricted Access";
    auth_basic_user_file /etc/nginx/.htpasswd;
    
    proxy_pass http://localhost:8080;
}