CVE-2026-26369 CRITICAL

CVE-2026-26369: JUNG eNet SMART HOME server 2.2.1/2.3.1 Privilege Escalation via setUserGroup

Vendor Jung
Product eNet SMART HOME server
Weakness CWE-269
Published February 15, 2026
Last update February 17, 2026
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

eNet SMART HOME server 2.2.1 and 2.3.1 contains a privilege escalation vulnerability due to insufficient authorization checks in the setUserGroup JSON-RPC method. A low-privileged user (UG_USER) can send a crafted POST request to /jsonrpc/management specifying their own username to elevate their account to the UG_ADMIN group, bypassing intended access controls and gaining administrative capabilities such as modifying device configurations, network settings, and other smart home system functions.

Key dates

02Disclosure timeline

February 15, 2026 CVE published
February 17, 2026 Record updated