CVE-2026-75960: Rently Smart Home Auth Bypass Vulnerability

CVE-2026-75960 Overview

CVE-2026-75960 affects Rently Smart Home versions 20.1.0 and prior. The vulnerability stems from insufficiently protected credentials [CWE-522] in the smart home platform. An authenticated attacker with low privileges can retrieve stored PINs, including the Master PIN, from the affected system. Retrieval of the Master PIN overrides standard user permission boundaries and grants unauthorized physical access control.

The flaw is reachable over the network and requires no user interaction. CISA published details in ICS Advisory ICSA-26-237-01.

Critical Impact
Attackers with low-privilege access can extract the Master PIN and bypass user permission controls, enabling unauthorized entry to smart-home-protected premises.

Affected Products

Rently Smart Home version 20.1.0
Rently Smart Home versions prior to 20.1.0

Discovery Timeline

2026-08-26 - CVE-2026-75960 published to NVD
2026-08-26 - Last updated in NVD database
2026 - CISA publishes ICS Advisory ICSA-26-237-01

Technical Details for CVE-2026-75960

Vulnerability Analysis

The vulnerability is classified as Insufficiently Protected Credentials [CWE-522]. Rently Smart Home stores or transmits PIN credentials without adequate protection controls. An authenticated user with low-level privileges can access PIN data beyond their authorization scope.

The Master PIN typically functions as an administrative override credential. Its exposure to lower-privilege accounts collapses the permission model that separates guests, tenants, staff, and administrators. Once retrieved, the Master PIN can be used at physical access points to bypass permission-based restrictions such as time windows, zone limits, or per-user access grants.

The attack surface is exposed over the network, which enables remote credential harvesting without physical proximity to a lock or hub.

Root Cause

The root cause is insufficient protection of PIN credentials at rest or in transit within the Rently Smart Home platform. Access controls on credential retrieval endpoints do not enforce the privilege separation required to keep the Master PIN and other PINs restricted to authorized administrators.

Attack Vector

Exploitation requires network access and valid low-privilege authentication to the Rently Smart Home platform. The attacker issues requests to credential-related functionality and receives PIN values, including the Master PIN, that should be inaccessible at that privilege level. No user interaction is required. Technical details are available in CISA ICS Advisory ICSA-26-237-01.

Detection Methods for CVE-2026-75960

Indicators of Compromise

Unexpected PIN retrieval or enumeration requests from low-privilege user sessions within Rently Smart Home.
Access events at smart locks using the Master PIN outside expected administrator activity windows.
Sudden increase in successful PIN-based unlock events tied to accounts with no historical administrative role.

Detection Strategies

Correlate API access logs against user role assignments to identify privilege boundary violations for credential endpoints.
Baseline normal PIN usage per user and alert on Master PIN entries that deviate from established administrator patterns.
Review authentication logs for low-privilege accounts issuing requests to endpoints that expose PIN or credential data.

Monitoring Recommendations

Forward Rently Smart Home application and access-control logs to a centralized log platform for retention and analysis.
Alert on any successful retrieval of the Master PIN and require ticket-based justification for administrator PIN reads.
Monitor for repeated authentication attempts from a single account followed by PIN retrieval calls.

How to Mitigate CVE-2026-75960

Immediate Actions Required

Inventory all Rently Smart Home deployments and identify systems running version 20.1.0 or earlier.
Rotate the Master PIN and any shared PINs on affected devices after applying the vendor fix.
Restrict network access to the Rently Smart Home management interface to trusted administrative networks.
Review recent access logs for signs of unauthorized PIN retrieval or unexpected Master PIN usage.

Patch Information

Refer to the vendor advisory referenced by CISA in ICS Advisory ICSA-26-237-01 for the fixed version and remediation instructions. Upgrade Rently Smart Home to a release later than 20.1.0 when available from the vendor.

Workarounds

Limit low-privilege account creation and audit existing accounts for necessity until patching is complete.
Segment smart home controllers on a dedicated VLAN and block inbound access from untrusted networks.
Enforce multi-factor authentication for administrator accounts on the Rently platform where supported.
Temporarily disable remote access features until the fixed version is deployed.

bash

# Example network restriction for the management interface
# Replace <mgmt_cidr> with the trusted administrator network
iptables -A INPUT -p tcp --dport 443 -s <mgmt_cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP