TI-2025-09778 CVE-2025-10681 · GHSA-wp3p-cjw9-x99v
Gardyn Mobile Application and Device Firmware Use Hard-coded Credentials
Priority MEDIUM 44
Storage credentials are hardcoded in the mobile app and device firmware.
Vulnerabilities
6 records
TI-2026-20353 CVE-2026-25197 · GHSA-m6m3-75j4-96wf
Gardyn Cloud API Authorization Bypass Through User-Controlled Key
Priority MEDIUM 48
A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.
TI-2026-22962 CVE-2026-28766 · GHSA-m7jc-wgg6-fhj3
Gardyn Cloud API Missing Authentication for Critical Function
Priority MEDIUM 46
A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.
TI-2026-22963 CVE-2026-28767 · GHSA-v4x2-mqq5-6xqv
Gardyn Cloud API Missing Authentication for Critical Function
Priority LOW 37
A specific administrative endpoint notifications is accessible without proper authentication.
TI-2026-25154 CVE-2026-32646 · GHSA-rj89-w4p6-78wv
Gardyn Cloud API Missing Authentication for Critical Function
Priority MEDIUM 44
A specific administrative endpoint is accessible without proper authentication, exposing device management functions.
TI-2026-25164 CVE-2026-32662 · GHSA-35v5-5w5j-5cx2
Gardyn Cloud API Active Debug Code
Priority LOW 36
Development and test API endpoints are present that mirror production functionality.