CVE-2026-27177
Stored XSS and Session Hijack in MajorDoMo IoT Endpoint
Publication date: 2026-02-18
Last updated on: 2026-02-20
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mjdm | majordomo | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in MajorDoMo is a stored cross-site scripting (XSS) issue found in the /objects/?op=set endpoint, which is intentionally left unauthenticated for IoT device integration.
User-supplied property values are stored directly in the database without any sanitization. When an administrator accesses the property editor in the admin panel, these stored values are rendered without escaping inside both a paragraph tag and a textarea element.
This causes the XSS to trigger automatically on page load without any action needed from the admin.
Additionally, the session cookie does not have the HttpOnly flag set, which allows attackers to steal the session cookie via JavaScript (document.cookie), enabling session hijacking.
Attackers can also enumerate properties through an unauthenticated API endpoint and inject malicious JavaScript into any property.
How can this vulnerability impact me? :
This vulnerability can lead to several security impacts:
- An attacker can execute arbitrary JavaScript in the context of the administrator's browser, potentially leading to full account compromise.
- Session hijacking is possible because the session cookie lacks the HttpOnly flag, allowing attackers to steal the admin's session cookie.
- Attackers can manipulate or poison properties in the system, potentially disrupting IoT device integrations or causing unauthorized actions.
- Overall, this can lead to unauthorized access, data theft, and manipulation of the system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know