CVE-2026-27180 — AI Deep Analysis Summary

🚨 **Essence**: MajorDoMo has an unauthenticated RCE via update poisoning. 📉 **Consequences**: Attackers poison update URLs, trigger forced updates, download malicious tarballs, and execute code on the server.…

🛡️ **CWE-494**: Download of Code from an Untrusted Source. 🐛 **Flaw**: The `saverestore` module exposes `admin()` via `/objects/?module=saverestore` without authentication.…

🏠 **Product**: MajorDoMo (Open-source DIY smart home platform). 👤 **Vendor**: sergejey. 📦 **Component**: `saverestore` module. ⚠️ **Scope**: Any instance running the vulnerable version without the fix from PR #1177.

👑 **Privileges**: Remote Code Execution (RCE) as the web server user. 💾 **Data**: Full access to document root, system files, and potentially other smart home devices.…

📉 **Threshold**: VERY LOW. 🔓 **Auth**: None required (Unauthenticated). 🌍 **Network**: Network-accessible (AV:N). 🚫 **UI**: No user interaction needed (UI:N). ⚡ **Complexity**: Low (AC:L).

🔓 **Public Exp**: YES. 📂 **PoC**: Available on GitHub (`mbanyamer/CVE-2026-27180-MajorDoMo-unauthenticated-RCE`). 📢 **Advisories**: VulnCheck and Chocapikk have published detailed analysis.…

🔍 **Check**: Scan for `/objects/?module=saverestore` endpoint. 🧪 **Test**: Attempt to access `admin()` method without login.…

✅ **Fixed**: YES. 📝 **Patch**: PR #1177 (`sergejey/majordomo#1177`) addresses the issue. 🔄 **Action**: Update MajorDoMo to the latest version including this PR.…

🚫 **Workaround**: Block external access to `/objects/` endpoint via WAF/NGINX. 🔒 **Restrict**: Disable automatic update features if possible. 🛑 **Network**: Isolate the MajorDoMo instance from the internet.…

🔴 **Priority**: CRITICAL (P1). 🚨 **Urgency**: IMMEDIATE action required. 📉 **CVSS**: 9.8 (Critical). ⏳ **Time**: Patch immediately to prevent RCE. 🏠 **Impact**: Smart home infrastructure is at risk.