Vendor
Gardyn
13 known vulnerabilities.
Products
5 results · Clear filters · Feed
-
Critical 10.0CVE-2026-13768 Public exploit
Gardyn IoT Hub Use of Hard-coded Credentials
Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key also allows a …
-
Critical 9.1CVE-2026-25197 Public exploit
Gardyn Cloud API Authorization Bypass Through User-Controlled Key
A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.
-
Critical 9.3CVE-2026-28766 Public exploit
Gardyn Cloud API Missing Authentication for Critical Function
A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.
-
Critical 9.1CVE-2025-1242 Public exploit
Administrative Credentials Can Be Extracted Through Gardyn API Responses
The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub…
-
Critical 9.4CVE-2025-29628 Public exploit
A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware bef…