Gardyn

13 CVEs across 9 Gardyn products. Browse Gardyn vulnerabilities, severities, and proof-of-concept exploits.

Gardyn products with known CVEs

ProductCVEs
Cloud API6
Gardyn Cloud API3
Gardyn Home Firmware3
Gardyn Studio Firmware3
Home Kit Firmware3
Home Kit1
Home Kit Cloud API1
Home Kit Mobile Application1
Mobile Application1
Gardyn CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-55726Medium5.32026-07-03The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device l…
CVE-2026-54477Medium5.42026-07-03The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks.
CVE-2026-13768Critical10.02026-07-03Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns…
CVE-2026-32662Medium5.32026-04-03Development and test API endpoints are present that mirror production functionality.
CVE-2026-32646High7.52026-04-03A specific administrative endpoint is accessible without proper authentication, exposing device management functions.
CVE-2026-28767Medium5.32026-04-03A specific administrative endpoint notifications is accessible without proper authentication.
CVE-2026-28766Critical9.32026-04-03A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.
CVE-2026-25197Critical9.12026-04-03A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.
CVE-2025-10681High8.62026-04-03Storage credentials are hardcoded in the mobile app and device firmware. These credentials do not adequately limit end user permissions and do not expire withi…
CVE-2025-1242Critical9.12026-02-25The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineer…
CVE-2025-29631Critical9.82025-07-25Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through…
CVE-2025-29629Critical9.12025-07-25Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for…
CVE-2025-29628Critical9.42025-07-25A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home Kit Mobile Applicat…