Gardyn IoT Hub

Summary

Vulnerabilities 3

• Critical 10.0
  CVE-2026-13768 Public exploit

  Gardyn IoT Hub Use of Hard-coded Credentials

  Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key also allows a …

  Gardyn Gardyn Cloud API Gardyn Studio Firmware Gardyn Home Firmware
  Jul 2, 2026
• Medium 5.4
  CVE-2026-54477 Public exploit

  Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax

  The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks.

  Gardyn Gardyn Studio Firmware Gardyn Home Firmware Gardyn Cloud API
  Jul 2, 2026
• Medium 5.3
  CVE-2026-55726 Public exploit

  Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control Sphere

  The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container.

  Gardyn Gardyn Home Firmware Gardyn Cloud API Gardyn Studio Firmware
  Jul 2, 2026

Revision history

1. 2026-07-02 #1

   Initial Publication

References

• ICSA Advisory ICSA-26-183-03 - Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-03
• Recommended Practices
  https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
• Recommended Practices
  https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• Recommended Practices
  https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
• Recommended Practices
  https://www.cisa.gov/topics/industrial-control-systems
• Recommended Practices
  https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
• Recommended Practices
  https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b
• Recommended Practices
  https://www.cisa.gov/secure-our-world/teach-employees-avoid-phishing
• Recommended Practices
  https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks