CVE-2026-26369 - Vulnerability Analysis

Overview

eNet SMART HOME server 2.2.1 and 2.3.1 contain a privilege escalation caused by insufficient authorization checks in the setUserGroup JSON-RPC method, letting low-privileged users elevate their privileges to admin, exploit requires low-privileged user access.

Severity & Score

Impact

Low-privileged users can gain administrative capabilities, allowing full control over device configurations and network settings.

Mitigation

Update to the latest version that fixes the authorization checks.

References

• https://www.vulncheck.com/advisories/jung-enet-smart-home-server-privilege-escalation-v
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5975.php

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 16, 2026

🔴 CVE-2026-26369 - Critical (9.8) eNet SMART HOME server 2.2.1 and 2.3.1 contains a privilege escalation vulnerability due to insufficient authorization checks in the setUserGroup JSON-RPC method. A low-privileged user (UG_USER) can send a crafted POST request to /jsonrpc/manageme... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26369/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner