CVE-2026-26369 — AI Deep Analysis Summary

🚨 **Essence**: eNet SMART HOME server has a critical flaw in its `setUserGroup` JSON-RPC method. <br>⚠️ **Consequences**: Attackers can bypass authorization checks, leading to **Privilege Escalation**.…

🛡️ **Root Cause**: **CWE-269** (Improper Privilege Management). <br>🔍 **Flaw**: The `setUserGroup` JSON-RPC endpoint lacks sufficient **authorization verification**.…

🏢 **Vendor**: JUNG (eNet). <br>📦 **Product**: eNet SMART HOME server. <br>📅 **Affected Versions**: Specifically **v2.2.1** and **v2.3.1**. <br>🌍 **Context**: Wireless smart home console by German company eNet.

🔓 **Hackers Can**: Escalate privileges from low-level users to **Administrative/High-level** access. <br>💾 **Impact**: Full control over the smart home system.…

📉 **Threshold**: **LOW**. <br>🔑 **Auth**: **PR:N** (No Privileges Required). <br>🌐 **Access**: **AV:N** (Network Accessible). <br>👀 **UI**: **UI:N** (No User Interaction needed).…

📜 **Public Exp?**: **Yes**, conceptually. <br>🔗 **Advisories**: ZSL-2026-5975 (ZeroScience) and VulnCheck Advisory confirm the flaw.…

🔍 **Self-Check**: Scan for **eNet SMART HOME server** services. <br>📡 **Target**: Look for JSON-RPC endpoints exposing `setUserGroup` methods.…

🛠️ **Official Fix**: The data does not list a specific patch version. <br>📢 **Status**: Advisory published on **2026-02-15**. <br>✅ **Action**: Check JUNG/eNet official channels for updates beyond v2.3.1.…

🚧 **Workaround**: <br>1. **Network Segmentation**: Isolate the smart home server from public/internet access. <br>2. **Access Control**: Restrict JSON-RPC API access to trusted internal IPs only. <br>3.…

🔥 **Urgency**: **CRITICAL**. <br>📊 **CVSS**: High severity (likely 9.0+ based on vector). <br>⏳ **Priority**: **P1**. <br>💡 **Reason**: Remote, unauthenticated privilege escalation in IoT infrastructure.…