JUNG eNet SMART HOME server 2.2.1/2.3.1 Arbitrary User Deletion via deleteUserAccount
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.4%
exploitation probability
0.4%top 70% of all CVEs
observed exploitation
nono source reports it
In short
A flaw in JUNG eNet SMART HOME server allows any regular user to delete other users' accounts by sending a specially crafted request. This is dangerous because it lets low-level users damage other accounts and disrupt system access for legitimate users.
Technical detail
The deleteUserAccount JSON-RPC method at /jsonrpc/management endpoint lacks proper authorization checks (CWE-862), allowing authenticated users with basic privileges (UG_USER) to delete arbitrary accounts via POST requests with crafted parameters. The vulnerability affects versions 2.2.1 and 2.3.1, with the admin account excluded from deletion.
Summary generated and translated by AI from the official description.
eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the deleteUserAccount JSON-RPC method that permits any authenticated low-privileged user (UG_USER) to delete arbitrary user accounts, except for the built-in admin account. The application does not enforce role-based access control on this function, allowing a standard user to submit a crafted POST request to /jsonrpc/management specifying another username to have that account removed without elevated permissions or additional confirmation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
JUNG · eNet SMART HOME server