MagicMirror is an open‑source smart mirror platform that, prior to version 2.37.0, enforces IP whitelisting only in the Express middleware layer. The Socket.IO server, however, is attached directly to the HTTP server without equivalent IP or origin checks, creating a CWE‑284 improper access control flaw. Because any client on the adjacent network can connect to module Socket.IO namespaces, the node_helper dispatches arbitrary events to socketNotificationReceived. Attackers can trigger server‑side requests from the default newsfeed and calendar helpers or, via the updatenotification helper, invoke child_process.exec when a third‑party module update is pending and the attacker supplies a custom update command through the socket CONFIG path. This allows an attacker to expose internal services, manipulate module state, or conditionally execute arbitrary commands on the host machine.

The vulnerability affects MagicMirror originated by MagicMirrorOrg. All releases prior to version 2.37.0 are impacted, including 2.36.x and earlier. Administrators should verify that their installation is running a version older than 2.37.0 to determine exposure.

The CVSS score of 2.3 indicates low overall risk, and the EPSS score is not available. The flaw is not listed in the CISA KEV catalog. A likely attack vector is a local or adjacent network client that bypasses the IP whitelist by connecting directly to the Socket.IO namespaces. Exploitation requires that the attacker can interact with the MagicMirror instance and that some default helpers are enabled. While the flaw does not provide immediate remote code execution in all scenarios, the ability to trigger child_process.exec via the updatenotification helper makes it a possible local privilege escalation or command execution exploit in vulnerable deployments.