JUNG eNet SMART HOME server 2.2.1/2.3.1 Privilege Escalation via setUserGroup

eNet SMART HOME server 2.2.1 and 2.3.1 contains a privilege escalation vulnerability due to insufficient authorization checks in the setUserGroup JSON-RPC method. A low-privileged user (UG_USER) can send a crafted POST request to /jsonrpc/management specifying their own username to elevate their account to the UG_ADMIN group, bypassing intended access controls and gaining administrative capabilities such as modifying device configurations, network settings, and other smart home system functions.

Problem type

Improper Privilege Management

Affected products

JUNG

eNet SMART HOME server

2.3.1 (46841) - AFFECTED

2.2.1 (46056) - AFFECTED

References

ZeroScience Vulnerability Advisory ZSL-2026-5975

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5975.php

third-party-advisory

VulnCheck Advisory: JUNG eNet SMART HOME server 2.2.1/2.3.1 Privilege Escalation via setUserGroup

https://www.vulncheck.com/advisories/jung-enet-smart-home-server-privilege-escalation-v

third-party-advisory

JSON source

https://cveawg.mitre.org/api/cve/CVE-2026-26369

Click to expand

{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "cveMetadata": {
    "cveId": "CVE-2026-26369",
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "dateUpdated": "2026-02-15T15:29:56.204Z",
    "dateReserved": "2026-02-15T15:02:46.359Z",
    "datePublished": "2026-02-15T15:29:56.204Z",
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck",
        "dateUpdated": "2026-02-15T15:29:56.204Z"
      },
      "datePublic": "2026-02-14T00:00:00.000Z",
      "title": "JUNG eNet SMART HOME server 2.2.1/2.3.1 Privilege Escalation via setUserGroup",
      "descriptions": [
        {
          "lang": "en",
          "value": "eNet SMART HOME server 2.2.1 and 2.3.1 contains a privilege escalation vulnerability due to insufficient authorization checks in the setUserGroup JSON-RPC method. A low-privileged user (UG_USER) can send a crafted POST request to /jsonrpc/management specifying their own username to elevate their account to the UG_ADMIN group, bypassing intended access controls and gaining administrative capabilities such as modifying device configurations, network settings, and other smart home system functions."
        }
      ],
      "affected": [
        {
          "vendor": "JUNG",
          "product": "eNet SMART HOME server",
          "versions": [
            {
              "version": "2.3.1 (46841)",
              "status": "affected"
            },
            {
              "version": "2.2.1 (46056)",
              "status": "affected"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "Improper Privilege Management",
              "cweId": "CWE-269",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5975.php",
          "name": "ZeroScience Vulnerability Advisory ZSL-2026-5975",
          "tags": [
            "third-party-advisory"
          ]
        },
        {
          "url": "https://www.vulncheck.com/advisories/jung-enet-smart-home-server-privilege-escalation-v",
          "name": "VulnCheck Advisory: JUNG eNet SMART HOME server 2.2.1/2.3.1 Privilege Escalation via setUserGroup",
          "tags": [
            "third-party-advisory"
          ]
        }
      ],
      "metrics": [
        {
          "format": "CVSS"
        },
        {
          "format": "CVSS",
          "cvssV3_1": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL"
          }
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "LiquidWorm as Gjoko Krstic of Zero Science Lab",
          "type": "finder"
        }
      ]
    }
  }
}