Which versions of eNet SMART HOME are affected by CVE-2026-26369?

eNet SMART HOME server versions 2.2.1 and 2.3.1 contain a privilege escalation vulnerability enabling authenticated low-privileged users to gain full administrator access to device configurations and…

Is there a public PoC exploit available for CVE-2026-26369?

Yes, a public proof-of-concept exploit is available for CVE-2026-26369. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-26369?

Within 24 hours, identify all eNet SMART HOME servers running versions 2.2.1 or 2.3.1 and implement network firewall rules restricting /jsonrpc/management endpoint access to only approved administrative systems. Within 7 days, audit all UG_USER accounts and remove unnecessary ones; enable detailed logging of setUserGroup JSON-RPC method calls to detect privilege escalation attempts; enforce strong password policies for remaining accounts. Within 30 days, initiate contact with eNet to establish a patch delivery timeline; if no patch is provided within 60 days, begin migration planning to alternative smart home management platforms.

eNet SMART HOME CVE-2026-26369

Q: What is the CVSS score of CVE-2026-26369?

CVE-2026-26369 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Improper Privilege Management (CWE-269)

2026-02-15 disclosure@vulncheck.com

Privilege Escalation Enet Smart Home Jung Group

8.7

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-accessible JSON-RPC endpoint requires only a low-privileged credential (PR:L); no scope change as impact is confined to the vulnerable server system.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 24, 2026 - 11:57 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 24, 2026 - 11:54 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 24, 2026 - 11:22 vuln.today

cvss_changed

Severity Changed

Aug 24, 2026 - 11:22 NVD

CRITICAL HIGH

CVSS changed

Aug 24, 2026 - 11:22 NVD

9.8 (CRITICAL) 8.7 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 28, 2026 - 01:34 vuln.today

Public exploit code

CVE Published

Feb 15, 2026 - 16:15 nvd

CRITICAL 9.8

DescriptionCVE.org

eNet SMART HOME server 2.2.1 and 2.3.1 contains a privilege escalation vulnerability due to insufficient authorization checks in the setUserGroup JSON-RPC method. A low-privileged user (UG_USER) can send a crafted POST request to /jsonrpc/management specifying their own username to elevate their account to the UG_ADMIN group, bypassing intended access controls and gaining administrative capabilities such as modifying device configurations, network settings, and other smart home system functions.

AnalysisAI

Privilege escalation in eNet SMART HOME server 2.2.1 and 2.3.1 allows authenticated low-privileged users to self-promote to administrator by exploiting a missing authorization check in the setUserGroup JSON-RPC method. Any UG_USER account can send a crafted POST request to /jsonrpc/management specifying their own username to join the UG_ADMIN group, granting full administrative control over device configurations, network settings, and smart home functions. A public proof-of-concept exploit exists per ZeroScience advisory ZSL-2026-5975, though EPSS remains at 0.02% (4th percentile), indicating limited observed exploitation at time of analysis; no CISA KEV listing is present.

Technical ContextAI

The vulnerability resides in the JSON-RPC management interface of the eNet SMART HOME server by JUNG Group, specifically the setUserGroup method exposed at the /jsonrpc/management HTTP endpoint. CWE-269 (Improper Privilege Management) identifies the root cause: the server performs no server-side validation that the authenticated caller possesses sufficient privilege to modify group memberships, allowing any account holder to submit their own username alongside a privileged group designation. The eNet platform is a building automation and smart home system used for centralized control of lighting, HVAC, and network-connected devices. Confirmed affected versions per CPE are cpe:2.3:a:jung-group:enet_smart_home:2.2.1:*:*:*:*:*:*:* and cpe:2.3:a:jung-group:enet_smart_home:2.3.1:*:*:*:*:*:*:*. The JSON-RPC protocol over HTTP is a common management interface pattern, and the flaw is a straightforward missing authorization guard rather than a logic bypass.

RemediationAI

No vendor-released patch has been identified at time of analysis for eNet SMART HOME 2.2.1 or 2.3.1; patch status is unknown and organizations should monitor the JUNG Group vendor channel and VulnCheck advisory at https://www.vulncheck.com/advisories/jung-enet-smart-home-server-privilege-escalation-v for updates. As an immediate compensating control, restrict access to the /jsonrpc/management endpoint to administrative IP ranges only via firewall or network ACL, preventing non-administrative user sessions from reaching the vulnerable method - note that this does not prevent exploitation by attackers already inside the permitted network segment. Additionally, enforce VPN or network-layer authentication before any management interface is reachable from user-facing network segments, raising the bar for exploitation. Audit all existing user accounts immediately to detect any UG_USER accounts that have been improperly elevated to UG_ADMIN. Deploy monitoring or IDS rules for POST requests to /jsonrpc/management where the calling session belongs to a non-admin user account invoking setUserGroup, as an early detection measure.