CVE-2026-26366criticalCWE-1392

CVE-2026-26366: critical vulnerability in JUNG eNet SMART HOME server

JUNG eNet SMART HOME server 2.2.1/2.3.1 Use of Default Credentials

Published · Updated

Follow this CVE+ Monitor eNet SMART HOME server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.7%
In short

JUNG eNet SMART HOME server comes with pre-set default usernames and passwords (user:user, admin:admin) that are never disabled, allowing anyone to log in and control your smart home system without permission.

Technical detail

The JUNG eNet SMART HOME server versions 2.2.1 and 2.3.1 ship with hardcoded default credentials that are not enforced to change during installation. An unauthenticated attacker can use these credentials to gain administrative access to smart home configuration and control functions. The vulnerability requires network access to the server interface but no prior authentication or user interaction.

Summary generated and translated by AI from the official description.
eNet SMART HOME server 2.2.1 and 2.3.1 ships with default credentials (user:user, admin:admin) that remain active after installation and commissioning without enforcing a mandatory password change. Unauthenticated attackers can use these default credentials to gain administrative access to sensitive smart home configuration and control functions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
JUNG · eNet SMART HOME server
Related CVEs — JUNG eNet SMART HOME server

In the same product, most dangerous first.

CVE-2026-26369HIGHJUNG eNet SMART HOME server 2.2.1/2.3.1 Privilege Escalation via setUserGroupEPSS 0.6%CVE-2026-26368HIGHJUNG eNet SMART HOME server 2.2.1/2.3.1 Account Takeover via resetUserPasswordEPSS 0.6%CVE-2026-26367HIGHJUNG eNet SMART HOME server 2.2.1/2.3.1 Arbitrary User Deletion via deleteUserAccountEPSS 0.4%