An unauthenticated stored XSS vulnerability in MajorDoMo allows remote attackers to execute malicious scripts in an administrator session, potentially leading to full administrative account takeover.

This vulnerability involves improper input sanitization within the /objects/?op=set endpoint, which is intentionally unauthenticated to facilitate IoT integration. Attackers can inject malicious scripts into property values that execute automatically when an administrator views the management panel, further exacerbated by the lack of HttpOnly flags on session cookies.

The ability for an unauthenticated attacker to inject persistent JavaScript into the administrative interface poses a severe risk of session hijacking and unauthorized administrative control. Given the CVSS score of 7.2, this vulnerability represents a high risk to the confidentiality and integrity of the IoT management environment, potentially allowing attackers to pivot deeper into the connected infrastructure.

Immediate Action: Since a formal patch is not confirmed, administrators should restrict network access to the /objects/ and /api.php/ endpoints to trusted IP addresses only.

Proactive Monitoring: Review web access logs for unusual activity on the /objects/?op=set and /api.php/data/ endpoints, specifically looking for script-based payloads in the request parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to inspect and block malicious payloads directed at the vulnerable endpoints.

Public Exploit Available: Yes — technical details and attack vectors are documented in the VulnCheck advisory and the referenced researcher write-up.

This vulnerability is highly dangerous because it bypasses authentication requirements to achieve cross-site scripting in a privileged administrative context. Organizations utilizing MajorDoMo must prioritize isolating the management interface from public network access immediately until a vendor-supplied security update is applied to remediate the lack of input sanitization and session security.