by Kastro
Paper/Archive/CVE-2026-26366

CVE-2026-26366

JUNG eNet SMART HOME server — JUNG eNet SMART HOME server 2.2.1/2.3.1 Use of Default Credentials

EPSS 0.7%public exploitCVSS 9.8
critical.is priorityof 100
50
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 53.9.539 × 2010.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

eNet SMART HOME server 2.2.1 and 2.3.1 ships with default credentials (user:user, admin:admin) that remain active after installation and commissioning without enforcing a mandatory password change. Unauthenticated attackers can use these default credentials to gain administrative access to sensitive smart home configuration and control functions.

Affected

ProductAffectedFixed inSource
eNet SMART HOME server2.3.1 (46841)–CNA
eNet SMART HOME server2.2.1 (46056)–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

writeupzeroscience.mk/en/vulnerabilities/ZSL-2026-5972.phpwriteupvulncheck.com/advisories/jung-enet-smart-home-server-use-of-default-credent