CVE Intelligence

Vulnerabilidades de Gardyn

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Gardyn: 10 registro(s), com severidade, exploração e correções.

Cloud API 9Gardyn Home Firmware 3Gardyn Studio Firmware 3Home Kit 1Home Kit Mobile Application 1Home Kit Cloud API 1Mobile Application 1

Somente exploradas (KEV) →

CVE-2026-55726 Média · 5.3 CWE-497 02/07/2026
Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control Sphere
The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container.
CVE-2026-54477 Média · 5.4 CWE-644 02/07/2026
Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax
The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks.
CVE-2026-13768 Crítica · 10.0 CWE-798 02/07/2026
Gardyn IoT Hub Use of Hard-coded Credentials
Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key also allows a malicious user to execute arbitrary commands on a specific connected device and may allow the malicious user to pivot to other devices on the user's network.
CVE-2026-32662 Média · 5.3 CWE-489 03/04/2026
Gardyn Cloud API Active Debug Code
Development and test API endpoints are present that mirror production functionality.
CVE-2026-32646 Alta · 7.5 CWE-306 03/04/2026
Gardyn Cloud API Missing Authentication for Critical Function
A specific administrative endpoint is accessible without proper authentication, exposing device management functions.
CVE-2026-28767 Média · 5.3 CWE-306 03/04/2026
Gardyn Cloud API Missing Authentication for Critical Function
A specific administrative endpoint notifications is accessible without proper authentication.
CVE-2026-28766 Alta · 7.5 CWE-306 03/04/2026
Gardyn Cloud API Missing Authentication for Critical Function
A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.
CVE-2026-25197 Alta · 8.1 CWE-639 03/04/2026
Gardyn Cloud API Authorization Bypass Through User-Controlled Key
A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.
CVE-2025-10681 Alta · 8.6 CWE-798 03/04/2026
Gardyn Mobile Application and Device Firmware Use Hard-coded Credentials
Storage credentials are hardcoded in the mobile app and device firmware. These credentials do not adequately limit end user permissions and do not expire within a reasonable amount of time. This vulnerability may grant unauthorized access to production storage containers.
CVE-2025-1242 Crítica · 9.1 CWE-798 25/02/2026
Administrative Credentials Can Be Extracted Through Gardyn API Responses
The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub exposing connected devices to malicious control.