Vulnerability · Published Feb 25, 2026 · Assigned by icscert
CVE-2025-1242Administrative Credentials Can Be Extracted Through Gardyn API Responses
Critical 9.1
In plain English
A critical-severity hard-coded credentials in Home Kit from Gardyn. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub exposing connected devices to malicious control.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Gardyn | Home Kit | 0 – before master.619 |
| Gardyn | Home Kit Mobile Application | 0 – before 2.11.0 |
| Gardyn | Home Kit Cloud API | 0 – before 2.12.2026 |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N