Skip to content
OpenAdvisories

Vendor

Gardyn

13 known vulnerabilities.

Gardyn at a glance

Last 12 months
10
Critical · all time
7
Exploited · all time
0
Public exploit · all time
11
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 1 vulnerability, 1 critical March 2026: 0 vulnerabilities Mar April 2026: 6 vulnerabilities, 2 critical May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 3 vulnerabilities, 1 critical August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202631
Jun 202600
May 202600
Apr 202662
Mar 202600
Feb 202611
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202533
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

Cloud API 6 Gardyn Home Firmware 3 Gardyn Studio Firmware 3 Gardyn Cloud API 3 Home Kit Firmware 3 Mobile Application 1 Home Kit 1 Home Kit Mobile Application 1 Home Kit Cloud API 1 Home Firmware 0 Studio Firmware 0

Latest advisories

  • Critical max 9.8
    ICSA-26-055-03 10 CVEs rev. 3

    Gardyn Home Kit (Update B)

    Successful exploitation of these vulnerabilities could allow unauthenticated users to access and control edge devices, access cloud-based devices and user information without authentication, and pivot to other edge devices managed in the Gardyn cloud environm…

    Gardyn
    first Feb 24, 2026
  • Critical max 10.0
    ICSA-26-183-03 3 CVEs

    Gardyn IoT Hub

    Successful exploitation of these vulnerabilities could allow unauthenticated users to access and control IoT Hub managed devices.

    Gardyn
All Critical High Medium Low Exploited only Public exploit

13 results · Feed

  • Medium 5.4
    CVE-2026-54477 Public exploit

    Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax

    The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks.

    Gardyn Gardyn Studio Firmware Gardyn Home Firmware Gardyn Cloud API
  • Medium 5.3
    CVE-2026-55726 Public exploit

    Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control Sphere

    The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container.

    Gardyn Gardyn Studio Firmware Gardyn Home Firmware Gardyn Cloud API
  • Critical 10.0
    CVE-2026-13768 Public exploit

    Gardyn IoT Hub Use of Hard-coded Credentials

    Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key also allows a …

    Gardyn Gardyn Home Firmware Gardyn Cloud API Gardyn Studio Firmware
  • High 8.6
    CVE-2025-10681 Public exploit

    Gardyn Mobile Application and Device Firmware Use Hard-coded Credentials

    Storage credentials are hardcoded in the mobile app and device firmware. These credentials do not adequately limit end user permissions and do not expire within a reasonable amount of time. This vulnerability may grant unauthorized access to production storag…

    Gardyn Cloud API Mobile Application
  • Critical 9.1
    CVE-2026-25197 Public exploit

    Gardyn Cloud API Authorization Bypass Through User-Controlled Key

    A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.

    Gardyn Cloud API
  • Critical 9.3
    CVE-2026-28766 Public exploit

    Gardyn Cloud API Missing Authentication for Critical Function

    A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.

    Gardyn Cloud API
  • Medium 5.3
    CVE-2026-28767 Public exploit

    Gardyn Cloud API Missing Authentication for Critical Function

    A specific administrative endpoint notifications is accessible without proper authentication.

    Gardyn Cloud API
  • High 7.5
    CVE-2026-32646 Public exploit

    Gardyn Cloud API Missing Authentication for Critical Function

    A specific administrative endpoint is accessible without proper authentication, exposing device management functions.

    Gardyn Cloud API
  • Medium 5.3
    CVE-2026-32662 Public exploit

    Gardyn Cloud API Active Debug Code

    Development and test API endpoints are present that mirror production functionality.

    Gardyn Cloud API
  • Critical 9.1
    CVE-2025-1242 Public exploit

    Administrative Credentials Can Be Extracted Through Gardyn API Responses

    The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub…

    Gardyn Home Kit Home Kit Cloud API Home Kit Mobile Application
  • Critical 9.8
    CVE-2025-29631

    Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.…

    Gardyn Home Kit Firmware
  • Critical 9.4
    CVE-2025-29628 Public exploit

    A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware bef…

    Gardyn Home Kit Firmware
  • Critical 9.1
    CVE-2025-29629

    Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.…

    Gardyn Home Kit Firmware