CISA Warns of Critical Credential Exposure in Rently Smart Home

The Cybersecurity and Infrastructure Security Agency (CISA) published advisory ICSA-26-237-01 on August 25, 2026, detailing a vulnerability in Rently Smart Home software. According to the advisory, versions of Rently Smart Home at 20.1.0 and prior are affected by an Insufficiently Protected Credentials vulnerability (CVE-2026-75960).

Successful exploitation could allow an attacker to retrieve pins, including the Master Pin, and override standard user permissions. The vulnerability impacts Commercial Facilities, Communications, and Information Technology sectors, with the product deployed in the United States and India.

Rently confirmed that the vulnerability was patched in late June 2026. The vendor stated that no user action is required for those running the patched version. For users on affected versions, updating to the latest release is recommended.

The vulnerability is tracked as CWE-522 (Insufficiently Protected Credentials). Two CVSS metric sets are provided: v3 with a base score of 8.1 (HIGH) and v4 with a base score of 8.7 (HIGH). Vectors indicate network-adjacent attack complexity, low attack complexity, and limited privileges required, with high confidentiality and integrity impacts.

CISA recommends minimizing network exposure for control system devices, ensuring they are not accessible from the internet, and locating control system networks behind firewalls isolated from business networks. When remote access is required, CISA advises using VPNs updated to the most current version. No known public exploitation targeting this vulnerability has been reported to CISA at this time.

The advisory was reported to CISA by Berk Dusunur. CISA also reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.