Log in Start free

Gardyn

Products

ProductCVEsExploitedLatest
Cloud API6–Apr 3, 2026
Gardyn Home Firmware3–Jul 2, 2026
Home Kit Firmware3–Jul 25, 2025
Gardyn Studio Firmware3–Jul 2, 2026
Gardyn Cloud API3–Jul 2, 2026
Mobile Application1–Apr 3, 2026
Home Kit1–Feb 25, 2026
Home Kit Cloud API1–Feb 25, 2026
Home Kit Mobile Application1–Feb 25, 2026

Exploited and recent CVEs

  • CVE-2026-54477 Medium 5.4 Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax 0.3%
  • CVE-2026-54477 Medium 5.4 Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax 0.3%
  • CVE-2026-54477 Medium 5.4 Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax 0.3%
  • CVE-2026-55726 Medium 5.3 Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control Sphere 0.5%
  • CVE-2026-55726 Medium 5.3 Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control Sphere 0.5%
  • CVE-2026-55726 Medium 5.3 Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control Sphere 0.5%
  • CVE-2026-13768 Critical 10.0 Gardyn IoT Hub Use of Hard-coded Credentials 0.7%
  • CVE-2026-13768 Critical 10.0 Gardyn IoT Hub Use of Hard-coded Credentials 0.7%
  • CVE-2026-13768 Critical 10.0 Gardyn IoT Hub Use of Hard-coded Credentials 0.7%
  • CVE-2025-10681 High 8.6 Gardyn Mobile Application and Device Firmware Use Hard-coded Credentials 0.4%
  • CVE-2025-10681 High 8.6 Gardyn Mobile Application and Device Firmware Use Hard-coded Credentials 0.4%
  • CVE-2026-25197 Critical 9.1 Gardyn Cloud API Authorization Bypass Through User-Controlled Key 0.3%
  • CVE-2026-28766 Critical 9.3 Gardyn Cloud API Missing Authentication for Critical Function 0.4%
  • CVE-2026-28767 Medium 5.3 Gardyn Cloud API Missing Authentication for Critical Function 0.4%
  • CVE-2026-32646 High 7.5 Gardyn Cloud API Missing Authentication for Critical Function 0.5%
  • CVE-2026-32662 Medium 5.3 Gardyn Cloud API Active Debug Code 0.3%
  • CVE-2025-1242 Critical 9.1 Administrative Credentials Can Be Extracted Through Gardyn API Responses 0.6%
  • CVE-2025-1242 Critical 9.1 Administrative Credentials Can Be Extracted Through Gardyn API Responses 0.6%
  • CVE-2025-1242 Critical 9.1 Administrative Credentials Can Be Extracted Through Gardyn API Responses 0.6%
  • CVE-2025-29628 Critical 9.4 A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API 0.3%
  • CVE-2025-29629 Critical 9.1 Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for secure shell access. This may result in 0.5%
  • CVE-2025-29631 Critical 9.8 Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through vulnerable methods that do not sanitize i 2.1%