PT-2026-8251 · Unknown · Enet Smart Home Server

Gjoko Krstic · Publicado 2026-02-15 · Atualizado 2026-02-15 · CVE-2026-26367

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions eNet SMART HOME server versions 2.2.1 through 2.3.1

Description The eNet SMART HOME server software has a flaw where authorization checks are absent in the deleteUserAccount JSON-RPC method. This allows a standard, authenticated user (UG USER) to remove other user accounts, with the exception of the built-in admin account. The application fails to implement role-based access control for this function. An attacker can send a specially crafted POST request to the /jsonrpc/management API endpoint, specifying a username to be deleted, without needing higher privileges or further confirmation. The vulnerable parameter is username.

Recommendations eNet SMART HOME server version 2.2.1: Implement proper role-based access control for the deleteUserAccount function. eNet SMART HOME server version 2.3.1: Implement proper role-based access control for the deleteUserAccount function.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-26367

Produtos afetados

Enet Smart Home Server

Referências · 8

• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2026-5973.php · Exploit
• https://t.me/CVEtracker/44773 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2023075614035476849 · Publicação no Twitter
• https://t.me/cveNotify/152067 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-26367 · Nota de Segurança
• https://vulncheck.com/advisories/jung-enet-smart-home-server-arbitrary-user-deletio · Nota
• https://osv.dev/vulnerability/CVE-2026-26367 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2023062013685944639 · Publicação no Twitter