A critical security flaw has been identified in **Rently Smart Home** devices, impacting versions 20.1.0 and prior. The vulnerability, designated **CVE-2026-75960**, stems from 'Insufficiently Protected Credentials,' a common weakness that can have severe consequences. ### The Threat: Master Pin Exposure Successful exploitation of **CVE-2026-75960** could grant an attacker the ability to retrieve sensitive information, most notably user pins, including the crucial Master Pin. With the Master Pin compromised, an attacker could effectively bypass and override all standard user permissions, gaining complete control over the affected smart home system. **CISA** has assigned a CVSS v3 score of 8.1 to this vulnerability, underscoring its high severity. The affected **Rently Smart Home** systems are known to be deployed in critical infrastructure sectors such as Commercial Facilities, Communications, and Information Technology, with a presence in the United States and India. ### Technical Details The core of the issue lies in **CWE-522: Insufficiently Protected Credentials**. This indicates that credentials are not adequately safeguarded against unauthorized access or disclosure within the system's architecture. **Berk Dusunur** is credited with reporting this vulnerability to **CISA**. ### Affected Products * **Vendor:** Rently * **Product:** Rently Smart Home * **Affected Versions:** <= 20.1.0 ### CISA's Recommended Practices **CISA** emphasizes the importance of defensive measures to minimize the risk of exploitation. Key recommendations for organizations and users include: * **Minimize Network Exposure:** Ensure that all control system devices and systems are not directly accessible from the internet. * **Network Segmentation:** Isolate control system networks and remote devices behind firewalls, separating them from business networks. * **Secure Remote Access:** When remote access is necessary, utilize secure methods such as Virtual Private Networks (VPNs). However, users should be aware that VPNs themselves can have vulnerabilities and must be kept up-to-date. The security of a VPN is also contingent on the security of connected devices. * **Impact Analysis:** Conduct thorough impact analysis and risk assessments before implementing any defensive measures. * **Cyber Defense Best Practices:** Refer to **CISA**'s resources on Industrial Control Systems (ICS) cybersecurity, including the "Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies" and "ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies." * **Social Engineering Awareness:** Train users to recognize and avoid social engineering and phishing attacks, advising against clicking suspicious links or opening unsolicited attachments. As of the initial release date, **CISA** has not reported any known public exploitation specifically targeting this vulnerability.