MagicMirror² is an open source smart mirror platform. Before version 2.37.0, the ipWhitelist was applied only as Express middleware, but the Socket.IO server was attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication. This flaw allows an unauthenticated client on an adjacent network to connect to Socket.IO namespaces and dispatch arbitrary events to socketNotificationReceived. Default helpers like newsfeed and calendar can make server-side requests to attacker-controlled URLs, and the updatenotification helper can execute commands via child_process.exec if an attacker supplies an update command through the socket CONFIG path. This vulnerability exposes internal services, allows manipulation of module-helper state, and conditional command execution. The vulnerability is resolved in MagicMirror version 2.37.0.

An unauthenticated attacker on an adjacent network can bypass intended IP whitelist restrictions and interact directly with the Socket.IO server namespaces. This can lead to exposure of internal services, manipulation of module-helper state, and conditional execution of commands on the server. The default modules can be abused to make server-side requests to attacker-controlled URLs and execute commands, increasing the risk of unauthorized access and potential system compromise. The CVSS score is low (2.3), indicating limited impact or exploitability conditions.

Upgrade MagicMirror to version 2.37.0 or later, where this improper access control vulnerability is fixed. No other official remediation or temporary fixes are documented. Until upgrading, restrict network access to trusted clients only to reduce exposure.