eNet Smart Home Server Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in eNet SMART HOME server versions 2.2.1 and 2.3.1. The issue arises from inadequate authorization checks in the JSON-RPC 'setUserGroup' method, allowing low-privileged users to send crafted POST requests that elevate their user rights to administrative levels. This exploitation bypasses access controls, enabling unauthorized users to modify device settings, network configurations, and other functions within the smart home system.

Impact

Exploitation of this vulnerability allows low-privileged users to gain administrative rights, enabling them to alter device configurations, network settings, and other critical functions within the smart home ecosystem.