eNet SMART HOME CVE-2026-26369

Exploitation requires a valid low-privileged (UG_USER) account on the eNet SMART HOME server - the CVSS PR:L metric confirms that unauthenticated exploitation is not possible. The attacker must have network-level access to the HTTP endpoint hosting /jsonrpc/management. No non-default configuration, special feature enablement, or specific platform variant is required beyond holding any standard user credential; the vulnerable setUserGroup method is part of the core management interface. Exploitation is bounded by the requirement for prior authenticated access, making the realistic threat actor either a malicious insider, a compromised user account holder, or an attacker who has already obtained low-privileged credentials through a separate means such as phishing or credential stuffing.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) correctly reflects low attack complexity and high impact once a low-privileged credential is held. However, EPSS at 0.02% (4th percentile) sharply contrasts with the public POC availability from ZeroScience, suggesting that while exploit code is accessible, actual mass exploitation has not materialized - consistent with the niche deployment footprint of the eNet platform. No CISA KEV listing further supports that active exploitation is not currently confirmed. The primary risk profile is insider threat or post-credential-theft escalation: an attacker who has phished or brute-forced a low-privileged smart home account can immediately obtain administrative control with no additional complexity. The CVSS signals are internally consistent - PR:L limits opportunistic internet-wide scanning, but the AC:L and AT:N metrics indicate trivial exploitation once that threshold is met. The overall priority should be moderate-to-high for organizations with eNet deployments, but the niche product footprint limits broader organizational exposure.

An attacker with any valid UG_USER account on the eNet SMART HOME server - obtained via phishing, credential reuse, or insider access - sends a single crafted POST request to /jsonrpc/management invoking the setUserGroup JSON-RPC method with their own username and the UG_ADMIN group value. The server, lacking a privilege check on the method, immediately promotes the account to administrator. The attacker then leverages full administrative capabilities to modify device configurations, alter network settings, or pivot within the building automation environment. A public proof-of-concept documenting this exact technique is available via ZeroScience advisory ZSL-2026-5975.