Jung-group vulnerabilities
We track 6 vulnerabilities in Jung-group products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on February 15, 2026.
Latest Jung-group vulnerabilities
- 8.8 High severity
eNet SMART HOME server: Improper Privilege Management
eNet SMART HOME server 2.2.1 and 2.3.1 contains a privilege escalation vulnerability due to insufficient authorization checks in the setUserGroup JSON-RPC method. A low-privileged user (UG_USER) can send a crafted POST request to /jsonrpc/management specifying
- 8.8 High severity
eNet SMART HOME server: Missing Authorization
eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the resetUserPassword JSON-RPC method that allows any authenticated low-privileged user (UG_USER) to reset the password of arbitrary accounts, including those in the UG_AD
- 8.1 High severity
eNet SMART HOME server: Missing Authorization
eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the deleteUserAccount JSON-RPC method that permits any authenticated low-privileged user (UG_USER) to delete arbitrary user accounts, except for the built-in admin account
- 9.8 Critical severity
eNet SMART HOME server: Use of Default Credentials
eNet SMART HOME server 2.2.1 and 2.3.1 ships with default credentials (user:user, admin:admin) that remain active after installation and commissioning without enforcing a mandatory password change. Unauthenticated attackers can use these default credentials to
- 7.5 High severity
JUNG Smart Visu Server: Missing Authentication for Critical Functionality
JUNG Smart Visu Server 1.1.1050 contains a denial of service vulnerability that allows unauthenticated attackers to remotely shutdown or reboot the server. Attackers can send a single POST request to trigger the server reboot without requiring any authenticati
- 8.8 High severity
JUNG Smart Visu Server: Improper Neutralization of HTTP Headers for Scripting Syntax
JUNG Smart Visu Server 1.1.1050 contains a request header manipulation vulnerability that allows unauthenticated attackers to override request URLs by injecting arbitrary values in the X-Forwarded-Host header. Attackers can manipulate proxied requests to gener