PT-2026-8252 · Unknown · Enet Smart Home Server

Gjoko Krstic · Publicado 2026-02-15 · Atualizado 2026-02-28 · CVE-2026-26368

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eNet SMART HOME server versions 2.2.1 and 2.3.1

Description The software contains a missing authorization flaw in the resetUserPassword JSON-RPC method. An authenticated, low-privileged user (UG USER) can reset the passwords of any account, including those with UG ADMIN and UG SUPER ADMIN privileges, without knowing the current password. This is achieved by sending a specially crafted JSON-RPC request to the /jsonrpc/management API endpoint. Successful exploitation allows an attacker to overwrite existing credentials, leading to account takeover and full administrative access with persistent privilege escalation.

Recommendations Update eNet SMART HOME server to a version beyond 2.3.1.

Exploit

Correção

LPE

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-26368

Produtos afetados

Enet Smart Home Server

Referências · 14

• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2026-5974.php · Exploit
• https://t.me/CVEtracker/44774 · Publicação no Telegram
• https://t.me/cveNotify/152068 · Publicação no Telegram
• https://twitter.com/cracbot/status/2024801260487180292 · Publicação no Twitter
• https://twitter.com/offseq/status/2023230894752891088 · Publicação no Twitter
• https://twitter.com/RedPacketSec/status/2023139168994394468 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2023062012750614880 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2023532024800391302 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2023339435799015769 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-26368 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2023073054109138952 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-26368 · Aviso do Fabricante
• https://t.me/cveNotify/153623 · Publicação no Telegram
• https://vulncheck.com/advisories/jung-enet-smart-home-server-account-takeover-via-r · Nota