Skip to content
OpenAdvisories
Critical ICSA-26-055-03 10 CVEs

Gardyn Home Kit (Update B)

Published Feb 24, 2026 · Updated Jul 2, 2026 · Revision 3

Vendor: Gardyn Product: Cloud API Product: Home Firmware Product: Mobile Application Product: Studio Firmware

Summary

Successful exploitation of these vulnerabilities could allow unauthenticated users to access and control edge devices, access cloud-based devices and user information without authentication, and pivot to other edge devices managed in the Gardyn cloud environment.

Vulnerabilities 10

  • Critical 9.8
    CVE-2025-29631

    Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.…

    Gardyn Home Kit Firmware
  • Critical 9.4
    CVE-2025-29628 Public exploit

    A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware bef…

    Gardyn Home Kit Firmware
  • Critical 9.3
    CVE-2026-28766 Public exploit

    Gardyn Cloud API Missing Authentication for Critical Function

    A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.

    Gardyn Cloud API
  • Critical 9.1
    CVE-2025-1242 Public exploit

    Administrative Credentials Can Be Extracted Through Gardyn API Responses

    The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub…

    Gardyn Home Kit Home Kit Cloud API Home Kit Mobile Application
  • Critical 9.1
    CVE-2025-29629

    Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.…

    Gardyn Home Kit Firmware
  • Critical 9.1
    CVE-2026-25197 Public exploit

    Gardyn Cloud API Authorization Bypass Through User-Controlled Key

    A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.

    Gardyn Cloud API
  • High 8.6
    CVE-2025-10681 Public exploit

    Gardyn Mobile Application and Device Firmware Use Hard-coded Credentials

    Storage credentials are hardcoded in the mobile app and device firmware. These credentials do not adequately limit end user permissions and do not expire within a reasonable amount of time. This vulnerability may grant unauthorized access to production storag…

    Gardyn Cloud API Mobile Application
  • High 7.5
    CVE-2026-32646 Public exploit

    Gardyn Cloud API Missing Authentication for Critical Function

    A specific administrative endpoint is accessible without proper authentication, exposing device management functions.

    Gardyn Cloud API
  • Medium 5.3
    CVE-2026-28767 Public exploit

    Gardyn Cloud API Missing Authentication for Critical Function

    A specific administrative endpoint notifications is accessible without proper authentication.

    Gardyn Cloud API
  • Medium 5.3
    CVE-2026-32662 Public exploit

    Gardyn Cloud API Active Debug Code

    Development and test API endpoints are present that mirror production functionality.

    Gardyn Cloud API

Revision history

  1. #3

    Update B - Adjusted the affected version numbers for the home and studio kit firmware. Changed recommended user action to update to a specific version number. The advisory now recommends that the user update to the most current version.

  2. #2

    Update A - Added vulnerabilities (CVE-2025-10681, CVE-2026-28766, CVE-2026-25197, CVE-2026-32646, CVE-2026-28767, CVE-2026-32662), modified mitigations as recommended by Gardyn, associated affected products with relevant vulnerabilities, updated product version numbers.

  3. #1

    Initial Publication

References