A vulnerability in Rently Smart Home could let an attacker retrieve access PINs, including the Master PIN, and override standard user permissions, the Cybersecurity and Infrastructure Security Agency said in an advisory published August 25. The affected versions are Smart Home 20.1.0 and earlier. CISA assigned the issue CVE-2026-75960 and described it as an insufficiently protected credentials vulnerability.
The flaw carries a high-severity CVSS 3.1 base score of 8.1. Under the CVSS 4.0 scale, it scores 8.7, also rated high. The published CVSS 3.1 vector indicates that exploitation can occur over a network with low attack complexity and without user interaction, but requires some level of prior privilege. CISA’s summary says successful exploitation could provide access to sensitive information and allow an attacker to override user permissions.
The credential exposure is the decisive risk. CISA specifically identifies PIN retrieval, including the Master PIN, as a possible result of exploiting the vulnerability. Because those PINs govern access and permissions within the smart-home product, obtaining them could allow an attacker to bypass restrictions assigned to standard users, according to the advisory. The weakness is mapped to CWE-522, which covers insufficiently protected credentials.
Rently patched the vulnerability in late June, before CISA’s public advisory. CISA states that no user action is required, while identifying Rently Smart Home as a known-affected product for versions 20.1.0 and prior. The advisory names Berk Dusunur as the person who reported the vulnerability to CISA and directs requests for more information to Rently at [email protected].
CISA lists Rently Smart Home deployments in the United States and India and places the product within the commercial facilities, communications, and information technology critical-infrastructure sectors. Those categories describe the advisory’s background classification; the notice does not identify a particular affected customer, installation, or incident.
CISA said it had received no reports of public exploitation specifically targeting CVE-2026-75960 at the time of publication. That status applies to known targeting of this vulnerability, not to a finding that exploitation is impossible. Organizations using systems associated with the product should continue to follow established internal procedures for suspected malicious activity and report relevant findings to CISA for tracking and correlation, as the agency recommends.
The agency’s defensive guidance calls for minimizing network exposure for control-system devices and systems and keeping them inaccessible from the public internet where possible. CISA also recommends placing control-system networks and remote devices behind firewalls and isolating them from business networks. When remote access is necessary, it advises using more secure methods such as virtual private networks, while noting that VPN security also depends on the connected devices and on keeping the VPN updated.
CISA advises organizations to conduct an impact analysis and risk assessment before deploying defensive measures. It also points users to its industrial-control-systems security guidance, including defense-in-depth practices and material on targeted cyber-intrusion detection and mitigation. For social-engineering protection, the agency says users should avoid links and attachments in unsolicited email messages. The immediate product-specific action remains Rently’s late-June patch, while CISA’s next-step guidance centers on exposure reduction, network isolation, monitoring, and established incident-reporting procedures.