eNet SMART HOME Server Missing Authorization Vulnerability in Password Reset Method Allows Account Takeover

A missing authorization vulnerability has been identified in eNet SMART HOME server versions 2.2.1 and 2.3.1. The issue resides in the resetUserPassword JSON-RPC method, where any authenticated low-privileged user can reset the passwords of arbitrary accounts, including those of administrators, without needing the current password or appropriate privileges. By sending a crafted JSON-RPC request to the management endpoint, an attacker can overwrite existing credentials, leading to unauthorized account access with full administrative rights and persistent privilege escalation.

Impact

Exploitation of this vulnerability allows for unauthorized account access, with full administrative rights, and persistent privilege escalation.