CVE-2026-26366

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-26366
eNet SMART HOME server 2.2.1 and 2.3.1 ships with default credentials (user:user, admin:admin) that remain active after installation and commissioning without enforcing a mandatory password change. Unauthenticated attackers can use these default credentials to gain administrative access to sensitive smart home configuration and control functions.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.vulncheck.com/advisories/jung-enet-smart-home-server-use-of-default-credent Broken Link
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5972.php Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:jung-group:enet_smart_home:2.2.1:*:*:*:*:*:*:*
cpe:2.3:a:jung-group:enet_smart_home:2.3.1:*:*:*:*:*:*:*
History

17 Jun 2026, 10:26

Type Values Removed Values Added
References () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5972.php - Third Party Advisory, Exploit () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5972.php - Exploit, Third Party Advisory

26 Feb 2026, 22:44

Type Values Removed Values Added
CPE cpe:2.3:a:jung-group:enet_smart_home:2.3.1:*:*:*:*:*:*:*
cpe:2.3:a:jung-group:enet_smart_home:2.2.1:*:*:*:*:*:*:*
References () https://www.vulncheck.com/advisories/jung-enet-smart-home-server-use-of-default-credent - () https://www.vulncheck.com/advisories/jung-enet-smart-home-server-use-of-default-credent - Broken Link
References () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5972.php - () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5972.php - Third Party Advisory, Exploit
First Time Jung-group enet Smart Home
Jung-group

18 Feb 2026, 17:52

Type Values Removed Values Added
Summary
  • (es) El servidor eNet SMART HOME 2.2.1 y 2.3.1 se envía con credenciales predeterminadas (usuario:usuario, admin:admin) que permanecen activas después de la instalación y puesta en marcha sin forzar un cambio de contraseña obligatorio. Atacantes no autenticados pueden usar estas credenciales predeterminadas para obtener acceso administrativo a funciones sensibles de configuración y control del hogar inteligente.

15 Feb 2026, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-15 16:15

Updated : 2026-06-17 10:26

NVD link : CVE-2026-26366

Mitre link : CVE-2026-26366

CVE.ORG link : CVE-2026-26366

JSON object : View

Products Affected

jung-group

  • enet_smart_home
CWE
CWE-1392

Use of Default Credentials