CVE-2026-1001

Think of Domoticz as a smart control board with names for devices and hardware. This bug lets a privileged user “hide” a malicious script inside those names, and the script gets saved and automatically runs in the browser whenever someone opens the affected hardware/device page. It’s like putting a sticky note with a trap inside a label—anyone who reads the label on the control board can get affected.

This matters if you run Domoticz and have administrative access configured for your staff or anyone else who can log into the Domoticz web interface as an admin. The bug requires an administrator to inject the malicious content, and then it impacts anyone who views the affected hardware/device page. It is only a risk if an attacker can reach the Domoticz admin functions (i.e., obtain administrative access to the Domoticz web interface).

This is RED because the vulnerability enables stored script execution and can let an attacker act through other users’ browser sessions once they have administrator access to Domoticz. While there are no clear, dated reports of exploitation for CVE-2026-1001 itself, the impact is session-level browser compromise and it’s fixed in 2026.1. Treat this as an urgent upgrade to remove the stored-XSS risk from your environment.

Confirm exposure

• Identify your current Domoticz version from the Domoticz web interface (e.g., the version/system information page) or from the installed application details.
• Determine whether your version is prior to 2026.1.

Upgrade to the fixed version

• Upgrade Domoticz to 2026.1 or later (the finding states Domoticz is fixed in 2026.1).
• If you have multiple environments (home/office/test), upgrade the most exposed one first—especially where staff log in to manage or view devices.

Reduce the “admin access” precondition risk (while patching)

• Audit who can log into the Domoticz web interface with administrative access.
• Remove any unnecessary admin accounts.
• If possible, ensure admin actions are only done from trusted devices and networks.

After upgrading

• Check for unexpected hardware/device name changes around the time of the upgrade planning or any suspicious changes.
• Watch browser/client and Domoticz behavior for signs of malicious scripts: unusual prompts, unexpected redirects, or sudden changes to device/hardware screens.

Workarounds if you cannot upgrade immediately

• The core precondition is that an attacker must have administrative access to the Domoticz web interface to inject the malicious content; therefore, the most effective interim control is to lock down admin access (remove unused admins, restrict who can access the web UI, and use trusted devices for admin sessions).

CISA KEV

• Not listed in CISA KEV for this CVE (so there is no KEV due date provided in the findings).

CVE-2026-1001 is a stored cross-site scripting vulnerability (CWE-79) in Domoticz hardware configuration/rename functionality. A high-privilege attacker (administrator of the Domoticz web interface) can supply crafted hardware/device names containing script/HTML markup; Domoticz stores this content and later renders it to other users without proper output encoding, causing JavaScript execution in their browsers (stored XSS).

Exploit status: no public exploit code is on record and no clear dated claims of exploitation specific to CVE-2026-1001 are provided in the findings. KEV is not listed.

Fix: Domoticz is fixed in 2026.1.

Attack characteristics from findings: requires administrative access to the Domoticz web interface and involves user interaction (other users must view the affected page). Public reachability in default configuration is not known from the findings.