Skip to main content

Gardyn CVE-2026-13768

| EUVDEUVD-2026-41464 CRITICAL
Use of Hard-coded Credentials (CWE-798)
2026-07-03 ics-cert@hq.dhs.gov GHSA-22gx-ghv9-47gj
Authentication Bypass
9.5
CVSS 4.0 · Vendor: hq
Share

Severity by source

Vendor (hq) PRIMARY
9.5 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
10.0 CRITICAL

Key grants network access with no per-user auth (PR:N) and full registry/command rights; scope changes (S:C) since one device's key controls the whole fleet and enables network pivot; availability impact only partial (A:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Primary rating from Vendor (hq).

CVSS VectorVendor: hq

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Patch available
Jul 03, 2026 - 02:01 EUVD
Analysis Generated
Jul 03, 2026 - 00:26 vuln.today

DescriptionCVE.org

Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key also allows a malicious user to execute arbitrary commands on a specific connected device and may allow the malicious user to pivot to other devices on the user's network.

AnalysisAI

Cloud takeover of Gardyn smart indoor garden devices is possible because a privileged Azure IoT Hub 'iothubowner' shared-access key is embedded in the product, letting a malicious actor query the IoT Hub Registry Manager to enumerate connection details for every Gardyn Home Kit and Studio device and then push arbitrary commands to a targeted unit. Because the key is service-level rather than per-device, one extracted credential compromises the entire fleet, and the attacker may pivot from a controlled device onto the victim's home or corporate LAN. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Extract embedded iothubowner key
Delivery
Authenticate to Azure IoT Hub Registry Manager
Exploit
Enumerate all Gardyn device connection strings
Execution
Send commands to target device
Persist
Execute arbitrary commands on device
Impact
Pivot to home network hosts
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to first obtain the privileged Azure IoT Hub 'iothubowner' shared-access key that Gardyn embeds in its product (reflected as AT:P in the CVSS 4.0 vector); once that single fleet-wide key is held, no per-user authentication is needed (PR:N) because the key itself authorizes IoT Hub Registry Manager calls, device enumeration, and command execution against any connected Home Kit or Studio device. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L, score 9.5) rates this Critical: network-reachable, low complexity, no privileges, no user interaction, with high confidentiality and integrity impact on both the vulnerable system and subsequent systems. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker extracts the embedded iothubowner key from Gardyn firmware or the companion mobile app, then calls the Azure IoT Hub Registry Manager to dump connection strings for every Home Kit and Studio device in the fleet. Using those credentials the attacker issues arbitrary commands to a chosen victim's device and attempts to pivot onto that user's home network; no public proof-of-concept is identified at time of analysis.
Remediation The fix is a vendor-side change: because the defect is a hard-coded/exposed service credential, the corrective action is Gardyn rotating and re-scoping the leaked iothubowner key and removing it from the device/app, so users should apply any firmware or app update Gardyn publishes and monitor https://mygardyn.com/security/ and CISA ICSA-26-183-03 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-03) for the patched version - no exact fixed version is stated in the available data, so this is Patch available per vendor advisory rather than a confirmed release. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

24 hours: Disconnect all Gardyn devices from networks; document device locations and network associations. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-798 – Use of Hard-coded Credentials

View all
CVE-2016-1560 CRITICAL POC
9.8
CVE-2017-14143 CRITICAL POC
9.8
CVE-2026-22769 CRITICAL
10.0
CVE-2016-5678 CRITICAL POC
9.8
CVE-2017-6558 CRITICAL POC
9.8
CVE-2015-7246 CRITICAL POC
9.8
CVE-2015-4667 CRITICAL POC
9.8
CVE-2016-10177 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2026-13768 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy