PT-2026-8253 · Unknown · Enet Smart Home Server

Gjoko Krstic

·

Published

2026-02-15

·

Updated

2026-02-28

·

CVE-2026-26369

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions eNet SMART HOME server versions 2.2.1 and 2.3.1
Description The eNet SMART HOME server is affected by a privilege escalation issue. Insufficient authorization checks within the setUserGroup JSON-RPC method allow a low-privileged user (UG USER) to elevate their account to the UG ADMIN group. This is achieved by sending a crafted POST request to the /jsonrpc/management API endpoint, specifying the user's own username. Successful exploitation grants administrative capabilities, including the ability to modify device configurations and network settings.
Recommendations eNet SMART HOME server version 2.2.1: At the moment, there is no information about a newer version that contains a fix for this vulnerability. eNet SMART HOME server version 2.3.1: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-26369

Affected Products

Enet Smart Home Server