Rently Smart Home EUVD-2026-66423

Exploitation requires the attacker to hold a valid low-privilege authenticated session on the Rently Smart Home platform - for example, a registered tenant account or any user-tier credential. The CVSS 4.0 PR:L metric confirms this authentication prerequisite. The vulnerability is network-accessible with no special configuration required beyond the standard deployed state of the application. Exploitation is limited by the need for prior account access; fully anonymous or unauthenticated exploitation is not supported by the available CVSS data. The physical impact is further gated by the attacker's ability to be present at the property or to hand off the retrieved PIN to a third party.

The CVSS 4.0 score of 8.7 is driven by a network-accessible (AV:N), low-complexity (AC:L), no-special-conditions (AT:N) attack requiring only low privileges (PR:L) and no user interaction, with high impact across vulnerable-system confidentiality, integrity, and availability. The PR:L metric is a meaningful limiting factor - some level of account registration or authentication is required, narrowing the exposed surface to registered users or compromised accounts rather than fully anonymous attackers. That said, in a property rental platform, a large number of tenants and managers hold legitimate low-privilege credentials, making the practical attacker pool broad. No KEV listing is present, so active exploitation is not confirmed; no POC has been identified either. EPSS data was not provided in the supplied intelligence, precluding probability-based exploitation forecasting. The physical security dimension - Master PIN retrieval enabling bypass of lock access controls across managed properties - substantially elevates real-world risk beyond what a purely digital credential leak would represent, and even a mid-sized property management operator should treat this as a high-priority remediation rather than routine patching. The high C/I/A impact scores in the provided vector are consistent with the description: full PIN retrieval enables account-level takeover and physical access override.

An attacker who has registered or compromised a low-privilege tenant account on the Rently Smart Home platform sends an authenticated API request to a credential-retrieval endpoint that lacks server-side authorization enforcement. The response returns PIN data for the property, including the Master Pin. The attacker then uses the Master Pin to physically access the property or override tenant-level access restrictions, bypassing all permission controls the platform is designed to enforce.