CVE-2026-26366

The record

eNet SMART HOME server 2.2.1 and 2.3.1 ships with default credentials (user:user, admin:admin) that remain active after installation and commissioning without enforcing a mandatory password change. Unauthenticated attackers can use these default credentials to gain administrative access to sensitive smart home configuration and control functions.

Affected packages

Related vulnerabilities

• CVE-2026-86464 In the current development version of Eclipse aeriOS, for which no official release has… CWE-1392
• CVE-2026-65313 A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering… CWE-1392
• CVE-2026-68503 LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. CWE-1392
• CVE-2026-46386 OpenProject is open-source, web-based project management software. CWE-1392
• CVE-2026-44273 Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain a Use of Default… CWE-1392
• CVE-2026-32652 Dell AIOps Collector versions prior to 1.18.3 contain a "Use of Default Credentials"… CWE-1392
• CVE-2026-50005 Brickcom cameras ship with default credentials that allows any unauthenticated remote… CWE-1392
• CVE-2026-9844 Use of default credentials vulnerability in Roche Diagnostics navify Digital Pathology… CWE-1392