eNet Smart Home Server Default Credentials Vulnerability

A vulnerability exists in eNet SMART HOME server versions 2.2.1 and 2.3.1, where the application is shipped with default credentials that remain active after installation. The default usernames and passwords (user:user and admin:admin) do not require a mandatory password change, allowing unauthenticated attackers to gain administrative access to sensitive smart home configurations and control functions.

Impact

Exploitation of this vulnerability allows for unauthorized administrative access, enabling attackers to manipulate sensitive smart home settings and controls.