CVE Intelligence
Analysis AI-assisted

CVE-2026-26366: JUNG eNet SMART HOME Server: Use of Default Credentials

JUNG eNet SMART HOME server versions 2.2.1 and 2.3.1 ship with default user and admin accounts that stay active after installation and commissioning. According to the record, unauthenticated attackers could use these accounts to reach administrative functions for smart home configuration and control. The recorded CVSS base score is 9.8 (critical), and no fixed version is listed in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes a use of default credentials weakness in the JUNG eNet SMART HOME server. Default user and admin accounts remain usable after installation and commissioning because the product does not enforce a mandatory password change. The CVE was published on 2026-02-15, with VulnCheck listed as the CNA. The record assigns CWE-1392, although its name field is empty.

Impact

  • According to the record, an unauthenticated remote attacker could gain administrative access.
  • Sensitive smart home configuration and control functions could be exposed.
  • The recorded CVSS metrics rate confidentiality, integrity and availability impact as high.

Affected products and versions

  • JUNG eNet SMART HOME server, versions 2.2.1 and 2.3.1.
  • The record also lists the same versions under the product name Jung-group Enet Smart Home.
  • The record does not state whether other versions are affected.

Exploitation status

The record shows that the product is not listed in the CISA KEV catalog. No confirmed active exploitation appears in the sources consulted. The record's SSVC data rates exploitation as proof of concept, and one third-party reference is tagged as exploit-related; its content was not used for this analysis. The recorded EPSS probability is about 0.66%, with a percentile of about 50.8%.

Remediation and mitigation

  • Change the default passwords on every installation and confirm that no account still uses a factory credential.
  • Contact the vendor to confirm whether an updated release is available, since no fixed version is listed in the record.
  • Keep the server off the public internet, place it on a segmented network, and restrict administrative access to trusted management hosts or VPN connections.
  • Treat devices that were commissioned without changing defaults as potentially compromised until credentials are rotated and logs are reviewed.

Detection guidance

  • Review authentication logs for logins using default account names from unexpected sources or at unexpected times.
  • Monitor for unexpected changes to server configuration or control settings.
  • Maintain an inventory of eNet SMART HOME servers and their software versions to prioritize review.

Limitations of the available information

  • The record contains no fixed versions, so the existence of a patch is unknown.
  • The record does not say whether default credentials can be changed through a supported interface.
  • The completeness of the affected version list is unknown.
  • The VulnCheck advisory link is marked as broken in the record, so the vendor-side details could not be verified from it.

Frequently asked questions

What is the core weakness in CVE-2026-26366?

The server versions 2.2.1 and 2.3.1 include default user and admin accounts that remain active after installation and commissioning, because a mandatory password change is not enforced.

Is there a fix available?

The record lists no fixed versions. Whether a patch exists is unknown, so administrators should contact the vendor and apply the defensive measures described in the analysis.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.