CVE-2026-26369

JUNG eNet SMART HOME server 2.2.1/2.3.1 Privilege Escalation via setUserGroup

Published Feb 15, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

eNet SMART HOME server 2.2.1 and 2.3.1 contains a privilege escalation vulnerability due to insufficient authorization checks in the setUserGroup JSON-RPC method. A low-privileged user (UG_USER) can send a crafted POST request to /jsonrpc/management specifying their own username to elevate their account to the UG_ADMIN group, bypassing intended access controls and gaining administrative capabilities such as modifying device configurations, network settings, and other smart home system functions.

Analysis

Technical impact

The eNet SMART HOME server 2.2.1 and 2.3.1 allows a low‑privileged user to send a crafted POST request to /jsonrpc/management, specifying their own username. This bypasses authorization checks in the setUserGroup method and escalates the account to UG_ADMIN, giving full administrative rights to modify device configurations, network settings, and other smart‑home functions. The weakness reflects improper authorization (CWE‑269).

Affected Systems

JUNG eNet SMART HOME server versions 2.2.1 and 2.3.1

Risk and Exploitability

The vulnerability has a CVSS score of 8.7, indicating critical severity. EPSS is reported as less than 1%, suggesting low to negligible exploitation probability, and it is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is a crafted POST request to the /jsonrpc/management endpoint, which a legitimate user can send with their own username to elevate privileges. Because the exploit requires only knowledge of the victim’s own username, it can be performed without additional reconnaissance, making this flaw particularly attractive for malicious actors who have already gained authenticated access to the system. Mitigating the risk requires the vendor to issue a patch or otherwise enforce proper authorization checks.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

JUNG

eNet SMART HOME server

affected

Version	Status	Constraints
`2.3.1 (46841)`	affected	—
`2.2.1 (46056)`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:jung-group:enet_smart_home:2.2.1:::::::*
	cpe:2.3:a:jung-group:enet_smart_home:2.3.1:::::::*

No data.

Vendor Product Versions

Jung

Enet Smart Home Server

Version	Status	Scheme	Platform
`2.3.1 (46841)`	affected	generic	—
`2.2.1 (46056)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the vendor patch or upgrade to a patched version as soon as it becomes available
Restrict network access to the /jsonrpc/management endpoint with firewall rules or subnet segmentation so that only trusted management devices can reach it
Enforce least privilege for user accounts by removing unnecessary group assignments and regularly review group membership to detect unauthorized changes

Generated by OpenCVE AI on August 24, 2026 at 11:29 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.603% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact total

References

Link	Providers
https://www.vulncheck.com/advisories/jung-enet-smart-home-server-privilege-escalation-v
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5975.php

History

Aug 24, 2026 10:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

Feb 28, 2026 1:45 AM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Jung-group Jung-group enet Smart Home
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:jung-group:enet_smart_home:2.2.1:::::::* cpe:2.3:a:jung-group:enet_smart_home:2.3.1:::::::*
Vendors & Products		Jung-group Jung-group enet Smart Home

Feb 17, 2026 5:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Feb 17, 2026 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Feb 16, 2026 12:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Jung Jung enet Smart Home Server
Vendors & Products		Jung Jung enet Smart Home Server

Feb 15, 2026 3:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		eNet SMART HOME server 2.2.1 and 2.3.1 contains a privilege escalation vulnerability due to insufficient authorization checks in the setUserGroup JSON-RPC method. A low-privileged user (UG_USER) can send a crafted POST request to /jsonrpc/management specifying their own username to elevate their account to the UG_ADMIN group, bypassing intended access controls and gaining administrative capabilities such as modifying device configurations, network settings, and other smart home system functions.
Title		JUNG eNet SMART HOME server 2.2.1/2.3.1 Privilege Escalation via setUserGroup
Weaknesses		CWE-269
References		https://www.vulncheck.com/advisories/jung-enet-smart-home-server-privilege-escalation-v https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5975.php
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`