{"id":"CVE-2026-75960","state":"PUBLISHED","title":"Insufficiently Protected Credentials in Rently Smart Home","description":"Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerability. This could allow an attacker to retrieve pins including the Master Pin, overriding standard user permissions.","publishedAt":"2026-08-26T13:20:19.920Z","updatedAt":"2026-08-26T17:10:54.255Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"icscert"},"assigner":"icscert","products":["Rently Smart Home"],"affected":[{"vendor":"Rently","product":"Smart Home","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"20.1.0","versionType":"custom"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-01"],"weaknesses":["CWE-522"],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/75xxx/CVE-2026-75960.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-75960","state":"PUBLISHED","datePublished":"2026-08-26T13:20:19.920Z","dateUpdated":"2026-08-26T17:10:54.255Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2026-08-18T16:32:03.997Z"},"containers":{"cna":{"title":"Insufficiently Protected Credentials in Rently Smart Home","descriptions":[{"lang":"en","value":"Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerability. This could allow an attacker to retrieve pins including the Master Pin, overriding standard user permissions."}],"affected":[{"vendor":"Rently","product":"Smart Home","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"20.1.0","versionType":"custom"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-01","tags":["government-resource"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":8.7,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseSeverity":"HIGH","baseScore":8.1,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}},{"other":{"type":"ssvc","content":{"options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CNA","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-522","lang":"en","description":"CWE-522: Insufficiently Protected Credentials","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2026-08-26T13:20:19.920Z"},"solutions":[{"lang":"en","value":"Rently has patched this vulnerability in late June. No user action is required.\n\n\n\nFor more information, contact Rently (support@rently.com).","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Rently has patched this vulnerability in late June. No user action is required.</p><p>For more information, contact Rently (support@rently.com).</p>"}]}],"credits":[{"lang":"en","value":"Berk Dusunur reported this vulnerability to CISA.","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-26T17:10:45.782840Z","id":"CVE-2026-75960","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-26T17:10:54.255Z"}}]}}}