PT-2026-8252 · Unknown · Enet Smart Home Server

Gjoko Krstic · Published 2026-02-15 · Updated 2026-02-28 · CVE-2026-26368

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eNet SMART HOME server versions 2.2.1 and 2.3.1

Description The software contains a missing authorization flaw in the resetUserPassword JSON-RPC method. An authenticated, low-privileged user (UG USER) can reset the passwords of any account, including those with UG ADMIN and UG SUPER ADMIN privileges, without knowing the current password. This is achieved by sending a specially crafted JSON-RPC request to the /jsonrpc/management API endpoint. Successful exploitation allows an attacker to overwrite existing credentials, leading to account takeover and full administrative access with persistent privilege escalation.

Recommendations Update eNet SMART HOME server to a version beyond 2.3.1.

Exploit

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-26368

Affected Products

Enet Smart Home Server

References · 14

• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2026-5974.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-26368 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26368 · Vendor Advisory
• https://t.me/CVEtracker/44774 · Telegram Post
• https://t.me/cveNotify/152068 · Telegram Post
• https://twitter.com/cracbot/status/2024801260487180292 · Twitter Post
• https://twitter.com/offseq/status/2023230894752891088 · Twitter Post
• https://twitter.com/RedPacketSec/status/2023139168994394468 · Twitter Post
• https://twitter.com/CVEnew/status/2023062012750614880 · Twitter Post
• https://twitter.com/TheHackerWire/status/2023532024800391302 · Twitter Post
• https://twitter.com/CveFindCom/status/2023339435799015769 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2023073054109138952 · Twitter Post
• https://t.me/cveNotify/153623 · Telegram Post
• https://vulncheck.com/advisories/jung-enet-smart-home-server-account-takeover-via-r · Note