CVE Intelligence
Analysis AI-assisted

CVE-2026-27179: MajorDoMo Unauthenticated SQL Injection in Commands Module

CVE-2026-27179 is an unauthenticated SQL injection in the commands module of MajorDoMo, a home automation platform, rated 9.8 by NVD. The sources describe a user-controlled parameter reaching several SQL queries without sanitization, which can enable credential extraction and administrative access. No confirmed exploitation appears in the sources consulted, and the record does not list affected or fixed versions.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-27179 affects the commands module of MajorDoMo, also known as Major Domestic Module. According to the record, user-supplied input reaches multiple SQL queries without sanitization or parameterized queries, and the module can be reached without authentication. The CWE classification is CWE-89 (SQL Injection).

Impact

  • The source describes time-based blind SQL injection as exploitable.
  • Because admin password hashes are described as unsalted MD5 stored in the users table, the sources state that successful exploitation could lead to credential extraction and administrative panel access.
  • NVD assigns a CVSS base score of 9.8 (critical). VulnCheck lists scores of 8.8 and 8.2 under its own assessments.

Affected products and versions

  • The record lists the products as "Mjdm Majordomo" and "Sergejey MajorDoMo".
  • The record states that the versions are not specified by the source. No affected version range can be confirmed from the available data.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • The SSVC exploitation field is recorded as none, and the EPSS probability is 0.007 (about 0.7 percent).
  • No confirmed exploitation in the wild appears in the sources consulted. Some referenced pages are tagged as exploit-related; this analysis does not reproduce any exploit material.

Remediation and mitigation

  • Check the vendor project and the upstream issue tracking reference for status on a fix. The record does not identify a fixed version.
  • Until a verified fix is applied, reduce exposure: restrict access to the MajorDoMo web interface to trusted networks and avoid exposing it directly to the internet.
  • Rotate administrator credentials after review, and enforce strong, unique passwords. Stronger password hashing is advisable given the MD5 storage described in the sources.
  • Review the VulnCheck advisory for vendor-independent guidance.

Detection guidance

  • Review web server and application logs for unusual requests targeting the commands module, especially from unknown sources and at high frequency.
  • Monitor for unexpected administrator logins, new administrative accounts, or changes to user records.
  • Watch for database latency anomalies or long-running queries that could indicate time-based probing.

Limitations of the available information

  • The record does not specify affected or fixed versions, so exposure cannot be determined by version.
  • The fixes list is empty. This means the record contains no fix information, not that no fix exists.
  • The EPSS record carries a date that should be verified against the source before relying on it.
  • Exploitation status reflects only the sources consulted.

Frequently asked questions

Is CVE-2026-27179 being actively exploited?

The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation in the wild appears in the sources consulted.

Which versions of MajorDoMo are affected?

The record does not specify affected versions, so the exposure cannot be determined by version from the available data.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.