MajorDoMo: Unauthenticated remote code execution via update poisoning (CVE-2026-27180)
A public proof-of-concept exploit is available for CVE-2026-27180, a critical vulnerability in MajorDoMo that allows unauthenticated remote code execution via update URL poisoning.
CVE search metadata
CVE search record: CVE-2026-27180. Severity: critical. CVSS: 9.8. EPSS: 1.20%. KEV: no. Product: MajorDoMo (All versions). Brief: MajorDoMo: Unauthenticated remote code execution via update poisoning (CVE-2026-27180). Brief link: https://feed.craftedsignal.io/briefs/2026-10-majordomo-rce/
Triage facts
Revision 1- Applicability
- MajorDoMo (All versions)
- Evidence
- Not observed
- Severity
- High
- Sources
- 3 public sources
- Freshness
- Revision 1Oct 30, 04:30 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B2Very likely
CVE-2026-27180 is a vulnerability in MajorDoMo smart home automation software allowing unauthenticated remote code execution. The vulnerability stems from a lack of authentication and integrity checks in the 'saverestore' module, enabling an attacker to poison the update source URL, trigger a forced update, and download malicious files into the web root. A public exploit for this vulnerability has been published.