The eNet SMART HOME server versions 2.2.1 and 2.3.1 contain a missing authorization flaw in the JSON‑RPC method resetUserPassword. An authenticated user with only low‑privileged rights (UG_USER) can invoke this method to reset the password of any account, including those in the UG_ADMIN and UG_SUPER_ADMIN groups, without providing the current password or possessing higher privileges. A crafted JSON‑RPC request sent to the /jsonrpc/management endpoint therefore allows an attacker to overwrite existing credentials, resulting in direct account takeover with full administrative access and persistent privilege escalation. The weakness is classified as CWE‑862, Unauthorized Access to Resource or Permissions.

The vulnerability affects the JUNG eNet SMART HOME server, specifically versions 2.2.1 and 2.3.1. No other product versions are listed in the CNA data, so only these releases are known to be impacted.

The CVSS score of 8.7 categorizes the flaw as high severity, and the EPSS score of less than 1% indicates a low exploitation probability under current threat landscapes. However, because the exploit requires only a logged‑in low‑privileged user and can be performed by sending a single crafted request, the practical effort to achieve elevation is minimal if an authenticated account is present. The CVE is not listed in the CISA KEV catalog, suggesting no confirmed active exploitation yet, but the potential remains significant due to the ability to gain full administrative control.