CISA: Flaw in Rently Smart Home Allows Retrieval of PINs and Master PIN

On August 25, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) published an advisory regarding a vulnerability in the Rently Smart Home product. The flaw, tracked as CVE-2026-75960, allows a user with minimal privileges to extract sensitive credentials, including user PINs and the Master PIN, bypassing authorization mechanisms. At the time of publication, no targeted active exploits have been observed, but the severity is high and no patch is yet available.

Advisory and Absence of Known Exploitation

The advisory ICSA-26-237-01, revision 1, was released by CISA on August 25, 2026. The discovery is attributed to researcher Berk Dusunur. The document does not report active exploitation campaigns specifically targeting this flaw. For this reason, CVE-2026-75960 is not listed in the KEV catalog of actively exploited vulnerabilities. The KEV catalog is reserved for flaws with confirmed exploits in real-world environments; currently there is no evidence of that. The absence of known exploits does not, however, reduce the need to act: the lack of a fix makes network mitigations the only available defense.

How the Vulnerability Works

The vulnerability is classified as CWE-522, "Insufficiently Protected Credentials". This category includes situations where credentials are stored in plaintext, hardcoded in code, or protected with weak cryptographic algorithms. The advisory does not specify which of these conditions affects Rently Smart Home, but the effect is the same: a user with limited access can read them.

In particular, an attacker who already has a low-privilege account (PR:L) can obtain user PINs, including the Master PIN. The Master PIN is a high-privilege credential that allows control of the entire smart home installation: locks, alarms, thermostats, and other connected devices. The attack does not require interaction with the victim (UI:N) and has low complexity (AC:L). Access occurs from the network (AV:N).

According to CVSS 3.1, the impact is high on confidentiality and integrity, but none on availability. The system continues to function, but an attacker can read sensitive data and modify it. The base score is 8.1, considered HIGH. The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

The CVSS 4.0 assessment, with a score of 8.7, adds a high impact on availability of the vulnerable system. The vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. In this case, the compromised system can be made unavailable, in addition to suffering data theft and alteration. There are no impacts on subsequent systems.

Who is Involved and Where

The affected product is Rently Smart Home, developed by Rently, a company based in the United States. All versions up to and including 20.1.0 are affected. The advisory indicates that the product is distributed in the United States and India. The listed critical infrastructure sectors are Commercial Facilities, Communications, and Information Technology.

Commercial Facilities includes commercial buildings, shopping centers, hotels, and similar facilities. Communications includes communication infrastructures. Information Technology covers enterprise IT systems. In all these contexts, Rently Smart Home can be used to manage physical access and automation. A compromise can therefore have direct consequences on building security and service availability. The advisory does not specify whether a corrected version exists after 20.1.0. At present, no dedicated patch is available.

Consequences for Users and Administrators

Users of Rently Smart Home must consider that an attacker able to authenticate, even with limited credentials, can read all user PINs. The theft of the Master PIN allows impersonating the administrator and unlocking doors, disabling security systems, or modifying configurations. If a building uses Rently for door locks, an attacker with the Master PIN could open all doors without leaving obvious traces.

The impact on confidentiality is evident: PINs are no longer secret. The impact on integrity means an attacker can change permissions or settings without authorization. No real-world exploitation cases are known, but the combination of high severity and absence of a patch makes the risk concrete for those who expose the device to the Internet or to non-isolated networks.

CISA's Recommendations

Since no patch is available, CISA recommends general defensive measures. The first is to minimize network exposure: Rently Smart Home devices must not be reachable from the Internet. They should be placed behind firewalls and isolated from corporate networks. If remote access is necessary, secure methods such as a VPN should be used, kept updated to the latest version and configured to restrict access only to authorized devices.

Before applying any defense, the advisory suggests performing an impact analysis and risk assessment. For those managing industrial control systems, CISA refers to the dedicated page at cisa.gov/ics and documents such as "Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies" and the technical information paper ICS-TIP-12-146-01B. On the social engineering front, the agency reminds users not to open attachments or click links in unsolicited emails, and to consult the guides "Recognizing and Avoiding Email Scams" and "Avoiding Social Engineering and Phishing Attacks".

There are no specific workarounds beyond network isolation. No software mitigation has been indicated by the vendor in the advisory.

Overall Picture

The vulnerability CVE-2026-75960 shows how a credential protection error can compromise an entire smart home system. The discovery by an external researcher, Berk Dusunur, indicates that the product has been analyzed and has security gaps. The absence of known exploits at the time of publication should not lead to complacency: the lack of a patch leaves users exposed to potential future attacks. Rently has not yet released information on timelines or methods for correction. In the meantime, the only effective strategy is to reduce the attack surface, isolating devices and limiting access.