CVE-2026-26368Disclosure(jung-group / enet_smart_home)

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch jung-group enet_smart_home systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the resetUserPassword JSON-RPC method that allows any authenticated low-privileged user (UG_USER) to reset the password of arbitrary accounts, including those in the UG_ADMIN and UG_SUPER_ADMIN groups, without supplying the current password or having sufficient privileges. By sending a crafted JSON-RPC request to /jsonrpc/management, an attacker can overwrite existing credentials, resulting in direct account takeover with full administrative access and persistent privilege escalation.

jung-group CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5974.php

Other references

https://www.vulncheck.com/advisories/jung-enet-smart-home-server-account-takeover-via-r

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

enet_smart_home

Threat summary

Patch or workaround signal is available
7 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 6 signals
Disclosure: 6 classified signals
Peaked 2d ago at 3 mentions (2026-02-15); latest day: 1
7 total mentions across 3 days

Affected systems

Vendors

jung-group

Products

enet_smart_home

2 versions affected across 1 product

Deep dive

Activity timeline7 mentions / 3d

Signal classification2 categories

Disclosure

685.7%

Patch

114.3%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-15	3	Disclosure3
2026-02-16	3	Disclosure2Patch1
2026-02-20	1	Disclosure1

Full discourse7 posts

Vulmon Vulnerability Feed@VulmonFeeds235d
Disclosure
CVE-2026-26368 Privilege Escalation Vulnerability in eNet SMART HOME Server via Password Reset https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26368
Post summary
This entry announces a privilege escalation vulnerability (CVE-2026-26368) in eNet SMART HOME Server that can be triggered via password reset, with no PoC, exploit, or patch information provided.
0001031
4.0K followersView on X
CRAC Learning - Tech@cracbot230d
Disclosure
CVE-2026-26368 (CVSS:8.7, HIGH) is Undergoing Analysis. eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the resetUserPassword JSON-RPC ..https://nvd.nist.gov/vuln/detail/CVE-2026-26368 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post discloses CVE‑2026‑26368, a missing‑authorization flaw in eNet SMART HOME server’s resetUserPassword JSON‑RPC with a CVSS score of 8.7, but contains no PoC, exploit, or patch information.
0000032
171 followersView on X
The Hacker Wire@TheHackerWire234d
Disclosure
🟠 CVE-2026-26368 - High eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the resetUserPassword JSON-RPC method that allows any authenticated low-privileged user (UG_USER) to r... https://www.thehackerwire.com/vulnerability/CVE-2026-26368/ https://t.co/YUU7Cp2G8l
Post summary
The eNet SMART HOME server 2.2.1/2.3.1 suffers from a missing authorization flaw in its resetUserPassword JSON‑RPC method, allowing low‑privileged authenticated users to exploit the issue.
0000040
112 followersView on X
CVEFind.com@CveFindCom234d
Disclosure
[CVE-2026-26368: HIGH] Vulnerability in eNet SMART HOME server allows low-privileged users to reset passwords of accounts without permission, leading to admin account takeover and persistent privilege escala...#cve,CVE-2026-26368,#cybersecurity https://cvefind.com/CVE-2026-26368
Post summary
The post announces CVE‑2026‑26368, noting that low‑privileged users can reset passwords and take over admin accounts on the eNet SMART HOME server, with no evidence of exploitation, PoC, or patch information.
0000041
580 followersView on X
OffSeq | Adversary Tactics for Cyber Resilience@offseq235d
Patch
🚨 HIGH severity! CVE-2026-26368 impacts JUNG eNet SMART HOME server (2.2.1, 2.3.1). Low-priv users can reset admin passwords — risk of account takeover! Patch ASAP & restrict access. Details: https://radar.offseq.com/threat/cve-2026-26368-missing-authorization-in-jung-enet--3a... https://t.co/jmYbVHei5h
Post summary
The tweet alerts users to a high‑severity vulnerability in Jung eNet SMART HOME servers that permits low‑privilege users to reset admin passwords, urging an immediate patch and access restrictions.
0000036
265 followersView on X
RedPacket Security@RedPacketSec235d
Disclosure
CVE Alert: CVE-2026-26368 - JUNG - eNet SMART HOME server - https://www.redpacketsecurity.com/cve-alert-cve-2026-26368-jung-enet-smart-home-server/ #OSINT #ThreatIntel #CyberSecurity #cve-2026-26368 #jung #enet-smart-home-server
Post summary
Red Packet Security has released a CVE alert for CVE-2026-26368 affecting the JUNG eNet SMART HOME server, with no additional technical details or exploitation information provided.
0000091
3.5K followersView on X
CVE@CVEnew235d
Disclosure
CVE-2026-26368 eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the resetUserPassword JSON-RPC method that allows any authenticated low-privi… https://www.cve.org/CVERecord?id=CVE-2026-26368
Post summary
The post discloses a missing authorization flaw in eNet SMART HOME server that lets low‑privilege users reset any password, but it does not provide evidence of exploitation, a PoC, or a patch.
00000621
56.4K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	jung-group	enet_smart_home	2.2.1	-	-
App	jung-group	enet_smart_home	2.3.1	-	-

Explore more

Back to dashboard jung-group CVEs enet_smart_home vulnerabilities

What researchers are saying

CVE-2026-26368

OffSeq | Adversary Tactics for Cyber Resilience[verified]@offseqPatch

The tweet alerts users to a high‑severity vulnerability in Jung eNet SMART HOME servers that permits low‑privilege users to reset admin passwords, urging an immediate patch and access restrictions.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

This entry announces a privilege escalation vulnerability (CVE-2026-26368) in eNet SMART HOME Server that can be triggered via password reset, with no PoC, exploit, or patch information provided.

CRAC Learning - Tech@cracbotDisclosure

The post discloses CVE‑2026‑26368, a missing‑authorization flaw in eNet SMART HOME server’s resetUserPassword JSON‑RPC with a CVSS score of 8.7, but contains no PoC, exploit, or patch information.

The Hacker Wire@TheHackerWireDisclosure

The eNet SMART HOME server 2.2.1/2.3.1 suffers from a missing authorization flaw in its resetUserPassword JSON‑RPC method, allowing low‑privileged authenticated users to exploit the issue.

CVEFind.com@CveFindComDisclosure

The post announces CVE‑2026‑26368, noting that low‑privileged users can reset passwords and take over admin accounts on the eNet SMART HOME server, with no evidence of exploitation, PoC, or patch information.

RedPacket Security@RedPacketSecDisclosure

Red Packet Security has released a CVE alert for CVE-2026-26368 affecting the JUNG eNet SMART HOME server, with no additional technical details or exploitation information provided.

CVE@CVEnewDisclosure

The post discloses a missing authorization flaw in eNet SMART HOME server that lets low‑privilege users reset any password, but it does not provide evidence of exploitation, a PoC, or a patch.