Regulatory

CISA warns of high-severity flaw in Rently Smart Home software

CISA published an advisory on Aug. 25 warning that a flaw in Rently Smart Home could expose sensitive information and let an attacker retrieve pins or override permissions.

CISA warned Aug. 25 that Rently Smart Home versions 20.1.0 and earlier are affected by a high-severity credential protection flaw identified as CVE-2026-75960.

The advisory says successful exploitation could allow an attacker to access sensitive information, retrieve pins including the Master Pin, and override standard user permissions. CISA rates the issue HIGH and lists the product as known_affected.

CISA said the product is deployed in the United States and India and is relevant to the Commercial Facilities, Communications and Information Technology sectors. The agency also said no known public exploitation specifically targeting this vulnerability had been reported to CISA at the time of publication.

CISA describes the issue as CWE-522, or insufficiently protected credentials. It lists a CVSS v3.1 base score of 8.1 with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, and a CVSS v4.0 base score of 8.7 with the vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

According to the advisory, Rently patched the vulnerability in late June, and CISA said no user action is required. The vendor contact listed in the advisory is [email protected].

The advisory credits Berk Dusunur with reporting the vulnerability to CISA.

CISA said it published the notice Aug. 25 and did not call for further action from users because the fix is already in place.