TI-2026-39330 CVE-2026-54477 · GHSA-9qxq-9wpj-4f86
Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax
Priority LOW 23
The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks.
Vulnerabilities
13 records
TI-2026-40224 CVE-2026-55726 · GHSA-pfg9-vjvh-f5rw
Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control Sphere
Priority LOW 37
The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication.
TI-2026-11608 CVE-2026-13768 · GHSA-22gx-ghv9-47gj
Gardyn IoT Hub Use of Hard-coded Credentials
Priority MEDIUM 50
Gardyn devices expose a privileged iothubowner key.
TI-2025-09778 CVE-2025-10681 · GHSA-wp3p-cjw9-x99v
Gardyn Mobile Application and Device Firmware Use Hard-coded Credentials
Priority MEDIUM 44
Storage credentials are hardcoded in the mobile app and device firmware.
TI-2026-20353 CVE-2026-25197 · GHSA-m6m3-75j4-96wf
Gardyn Cloud API Authorization Bypass Through User-Controlled Key
Priority MEDIUM 48
A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.
TI-2026-22962 CVE-2026-28766 · GHSA-m7jc-wgg6-fhj3
Gardyn Cloud API Missing Authentication for Critical Function
Priority MEDIUM 46
A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.
TI-2026-22963 CVE-2026-28767 · GHSA-v4x2-mqq5-6xqv
Gardyn Cloud API Missing Authentication for Critical Function
Priority LOW 37
A specific administrative endpoint notifications is accessible without proper authentication.
TI-2026-25154 CVE-2026-32646 · GHSA-rj89-w4p6-78wv
Gardyn Cloud API Missing Authentication for Critical Function
Priority MEDIUM 44
A specific administrative endpoint is accessible without proper authentication, exposing device management functions.
TI-2026-25164 CVE-2026-32662 · GHSA-35v5-5w5j-5cx2
Gardyn Cloud API Active Debug Code
Priority LOW 36
Development and test API endpoints are present that mirror production functionality.
TI-2025-01062 CVE-2025-1242 · GHSA-7gqx-qgr9-rhw9
Administrative Credentials Can Be Extracted Through Gardyn API Responses
Priority MEDIUM 49
The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering.
TI-2025-21149 CVE-2025-29631 · GHSA-4993-4c8h-h8w5
OS command injection in Gardyn Home Kit Firmware
Priority HIGH 82
Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through vulnerable methods that do not sanitize input before passing…
TI-2025-21148 CVE-2025-29629 · GHSA-7422-rhq7-3wfj
Information disclosure in Gardyn Home Kit Firmware
Priority HIGH 74
Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for secure shell access.
TI-2025-21147 CVE-2025-29628 · GHSA-82xm-jwxq-4436
Information disclosure in Gardyn Home Kit Firmware
Priority HIGH 82
A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 le…