Critical severity9.8NVD Advisory· Published Feb 15, 2026· Updated Jun 17, 2026
CVE-2026-26369
CVE-2026-26369
Description
eNet SMART HOME server 2.2.1 and 2.3.1 contains a privilege escalation vulnerability due to insufficient authorization checks in the setUserGroup JSON-RPC method. A low-privileged user (UG_USER) can send a crafted POST request to /jsonrpc/management specifying their own username to elevate their account to the UG_ADMIN group, bypassing intended access controls and gaining administrative capabilities such as modifying device configurations, network settings, and other smart home system functions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:a:jung-group:enet_smart_home:2.2.1:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:jung-group:enet_smart_home:2.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:jung-group:enet_smart_home:2.3.1:*:*:*:*:*:*:*
- Range: 2.2.1, 2.3.1
- JUNG/eNet SMART HOME serverv5Range: 2.3.1 (46841)
Patches
Vulnerability mechanics
References
2- www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5975.phpnvdExploitThird Party Advisory
- www.vulncheck.com/advisories/jung-enet-smart-home-server-privilege-escalation-vnvdBroken Link
News mentions
0No linked articles in our index yet.