CVE-2026-27175: MajorDoMo OS Command Injection RCE Flaw

CVE-2026-27175 Overview

MajorDoMo (aka Major Domestic Module), a popular open-source home automation platform, contains an unauthenticated OS command injection vulnerability in the rc/index.php endpoint. The vulnerability allows remote attackers to execute arbitrary system commands by exploiting a race condition between the command queue system and a polling worker script.

The attack exploits improper input sanitization where the $param variable from user input is interpolated into a command string within double quotes without being sanitized via escapeshellarg(). This command is then inserted into a database queue by the safe_exec() function, which performs no sanitization. The cycle_execs.php script, accessible without authentication, retrieves these queued commands and passes them directly to PHP's exec() function.

Critical Impact

Unauthenticated remote attackers can achieve complete system compromise by injecting malicious shell commands that execute within approximately one second, potentially gaining full control over the home automation system and the underlying server.

Affected Products

• MajorDoMo (Major Domestic Module) - versions prior to security patch
• Home automation deployments running vulnerable MajorDoMo instances
• Self-hosted MajorDoMo installations with publicly accessible rc/index.php and cycle_execs.php endpoints

Discovery Timeline

• 2026-02-18 - CVE CVE-2026-27175 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-27175

Vulnerability Analysis

This command injection vulnerability (CWE-78) exploits a dangerous combination of missing input validation and a race condition in MajorDoMo's command execution architecture. The vulnerability is network-accessible and requires no authentication or user interaction, making it trivially exploitable by remote attackers.

The core issue stems from the application's failure to sanitize user-supplied input before incorporating it into shell commands. When user input containing the $param variable reaches the rc/index.php endpoint, it is directly interpolated into a command string enclosed in double quotes. In shell environments, double quotes allow for variable expansion and command substitution, meaning shell metacharacters like backticks, $(...), and semicolons will be interpreted and executed.

Root Cause

The root cause is twofold: First, the rc/index.php endpoint fails to apply escapeshellarg() or equivalent sanitization to user-supplied input before constructing shell commands. Second, the safe_exec() function, despite its misleading name, performs no actual security validation and merely queues commands for later execution. The cycle_execs.php script then blindly executes these queued commands via PHP's exec() function without any security checks.

This design creates a dangerous trust relationship between components that should never trust user-supplied data. The use of double quotes around the interpolated variable is particularly problematic, as shell metacharacters remain active within double-quoted strings.

Attack Vector

The attack is network-based and exploits a race condition in the command execution workflow. An attacker first triggers the cycle_execs.php script, which purges the existing command queue and enters a polling loop waiting for new commands. While this worker is actively polling, the attacker sends a malicious request to the rc/index.php endpoint containing shell metacharacters embedded in the payload.

Because the command is inserted into the database queue and the worker is already polling, the malicious command is retrieved and executed almost immediately—typically within one second. The shell metacharacters expand inside the double-quoted command string, enabling arbitrary command execution with the privileges of the web server process.

The vulnerability mechanism involves user input being directly interpolated into shell commands within double quotes, bypassing the intended security of the safe_exec() function. For detailed technical analysis and proof-of-concept information, see the Chocapikk Blog Post and the Vulncheck Security Advisory.

Detection Methods for CVE-2026-27175

Indicators of Compromise

• Unusual HTTP requests to rc/index.php or cycle_execs.php containing shell metacharacters such as backticks, $(...), semicolons, or pipe characters
• Unexpected process spawning from the web server process (e.g., www-data or apache)
• Database entries in the command queue containing shell injection patterns
• Web server access logs showing sequential requests to cycle_execs.php followed immediately by requests to rc/index.php

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing shell metacharacters in parameters sent to the rc/ endpoint
• Monitor for anomalous process creation from PHP or web server parent processes, particularly reverse shells or reconnaissance commands
• Enable database query logging to identify suspicious command insertions into the execution queue
• Deploy endpoint detection to identify post-exploitation activities such as persistence mechanisms or lateral movement

Monitoring Recommendations

• Configure alerting for any access to cycle_execs.php from external IP addresses, as this endpoint should typically only be accessed internally
• Implement log correlation to detect the attack pattern of sequential requests to cycle_execs.php and rc/index.php within a short time window
• Monitor outbound network connections from the MajorDoMo server for potential reverse shell callbacks or data exfiltration

How to Mitigate CVE-2026-27175

Immediate Actions Required

• Restrict network access to the MajorDoMo installation, particularly the rc/index.php and cycle_execs.php endpoints
• Implement authentication requirements for all administrative and execution endpoints
• Place the MajorDoMo server behind a reverse proxy with strict input validation rules
• Review system logs for indicators of prior exploitation

Patch Information

A security fix is available via the GitHub Pull Request #1177. Organizations should review and apply this patch immediately. The fix should properly sanitize user input using escapeshellarg() before incorporating it into shell commands and prevent direct execution of database-queued commands without validation.

For additional context, see the Vulncheck Security Advisory.

Workarounds

• Implement firewall rules to block external access to rc/index.php and cycle_execs.php, restricting access to trusted internal IP addresses only
• Configure web server authentication (HTTP Basic Auth or similar) for the vulnerable endpoints as a temporary measure
• If feasible, disable the cycle_execs.php script entirely until the patch can be applied
• Consider deploying the application in an isolated network segment or Docker container with restricted capabilities

# Example: Restrict access to vulnerable endpoints via Apache configuration
<Location "/rc/">
    Require ip 127.0.0.1
    Require ip 192.168.1.0/24
</Location>

<Location "/cycle_execs.php">
    Require ip 127.0.0.1
</Location>