Gardyn

Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through vulnerable methods that do not sanitize input before passing…

A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 le…

Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for secure shell access.

Gardyn devices expose a privileged iothubowner key.

The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering.

A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.

A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.

A specific administrative endpoint is accessible without proper authentication, exposing device management functions.

Storage credentials are hardcoded in the mobile app and device firmware.

The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication.

A specific administrative endpoint notifications is accessible without proper authentication.

Development and test API endpoints are present that mirror production functionality.

The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks.