CVE-2026-26366 JUNG eNet SMART HOME server 2.2.1/2.3.1 Use of Default Credentials
Attackers can use default credentials to gain administrative access to the smart home server, allowing them to modify configuration and control functions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-26366?
CVE-2026-26366 is a critical vulnerability in JUNG eNet SMART HOME server, published on 15 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
eNet SMART HOME server 2.2.1 and 2.3.1 ships with default credentials (user:user, admin:admin) that remain active after installation and commissioning without enforcing a mandatory password change. Unauthenticated attackers can use these default credentials to gain administrative access to sensitive smart home configuration and control functions.
Weakness: CWE-1392
Which versions are affected by CVE-2026-26366?
It affects 1 product.
Products include Jung-Group Enet Smart Home.
How do I fix CVE-2026-26366?
No fix has been published for CVE-2026-26366 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-26366 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-26366 exists.
Other vulnerabilities in JUNG eNet SMART HOME server
Sources
Also known as GHSA-5cwq-67p7-h8hr.