A stored cross‑site scripting flaw exists on the MajorDoMo /objects/?op=set endpoint, which accepts property values without sanitization and stores them directly in the database. When an administrator opens the property editor, the unsanitized data is rendered inside a paragraph tag and a textarea on page load, automatically executing any embedded script. The vulnerability also allows an attacker, via the unauthenticated /api.php/data/ endpoint, to enumerate properties and inject malicious JSON to poison them. In addition, session cookies are transmitted without the HttpOnly flag, permitting session hijack through document.cookie exfiltration. The exposed defect therefore lets a remote unauthenticated user permanently compromise the administrator interface, potentially gaining full control over the device and its network traffic.

MajorDoMo (Major Domestic Module) provided by sergejey. No specific product version numbers are listed in the CNA data; therefore any deployment where the /objects/?op=set endpoint is exposed as documented is vulnerable.

The vulnerability scores a CVSS of 5.3, indicating moderate severity, with an EPSS score stored in the (0%,1%) interval and absence from the CISA KEV catalog. Attackers do not require credentials; the unauthenticated property endpoint is the primary attack vector. Exploitation involves submitting a crafted property value containing JavaScript, causing arbitrary script execution when an admin loads the property editor. Given the lack of authentication and the impairing session cookie flag, the risk is significant for environments where the device is accessed remotely or managed by administrators with elevated privileges.