CVE-2026-26366
Unauthenticated attackers can use these default credentials to gain administrative access to sensitive smart home configuration and control functions.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.65%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
eNet SMART HOME server 2.2.1 and 2.3.1 ships with default credentials (user:user, admin:admin) that remain active after installation and commissioning without enforcing a mandatory password change. Unauthenticated attackers can use these default credentials to gain administrative access to sensitive smart home configuration and control functions.
- CVSS 4.0
- 9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.65% probability · 49th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1392
- Affected
- jung-group/enet smart home
- Source
- disclosure@vulncheck.com
References
- https://www.vulncheck.com/advisories/jung-enet-smart-home-server-use-of-default-credentBroken Link
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5972.phpExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.