CVE-2026-75960: CWE-522: Insufficiently Protected Credentials in Rently Smart Home

CVE-2026-75960 affects Rently Smart Home versions 20.1.0 and prior. The vulnerability involves insufficient protection of credentials, specifically allowing an attacker to retrieve PIN codes such as the Master PIN. This bypasses standard user permission controls, potentially granting unauthorized access to the smart home system. The CVSS 4.0 base score is 8.7, indicating a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability does not have an official remediation or patch available at this time, and there are no known exploits in the wild.

An attacker can obtain sensitive PINs including the Master PIN, which overrides standard user permissions. This could lead to unauthorized control of the smart home system. The vulnerability is exploitable remotely without user interaction and requires only low privileges, increasing the risk of compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published by Rently. Users should monitor vendor communications for updates and consider restricting network access to the affected devices until a patch is available.