CVE-2026-26369

Katalog CVE

CVSS 8.8 · High EPSS 0,58%

Kerentanan Improper Privilege Management pada jung-group enet smart home. Skor CVSS 3.1 8.8 (High) menurut vulncheck.com.

Deskripsi (NVD)

eNet SMART HOME server 2.2.1 and 2.3.1 contains a privilege escalation vulnerability due to insufficient authorization checks in the setUserGroup JSON-RPC method. A low-privileged user (UG_USER) can send a crafted POST request to /jsonrpc/management specifying their own username to elevate their account to the UG_ADMIN group, bypassing intended access controls and gaining administrative capabilities such as modifying device configurations, network settings, and other smart home system functions.

Rincian

Terbit di NVD

15 Februari 2026

Terakhir diubah

24 Agustus 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

0,58% peluang dieksploitasi; lebih tinggi dari 46,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5975.php exploit · advisory pihak ketiga
• https://www.vulncheck.com/advisories/jung-enet-smart-home-server-privilege-escalation-v broken link