EUVD-2026-41465
GHSA-pfg9-vjvh-f5rw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated cloud listing with low confidentiality impact only; no integrity, availability, or scope-change impact supported by description.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
5DescriptionCVE.org
The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container.
AnalysisAI
Unauthenticated public listing of an Azure Blob Storage container exposes device log files across the entire Gardyn smart garden fleet to any internet-accessible actor. The misconfiguration affects all versions of Gardyn Home Firmware, Gardyn Studio Firmware, and the Gardyn Cloud API, meaning no specific patched version bounds the exposure - it is architectural rather than release-specific. Reported via ICS-CERT advisory ICSA-26-183-03, no confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, though exploitation requires zero technical prerequisites beyond internet access and knowledge of the container URL.
Technical ContextAI
Gardyn produces consumer IoT smart indoor garden devices (Home and Studio lines) that stream telemetry and operational logs to a cloud backend built on the Gardyn Cloud API. Per CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the root cause is a misconfigured Microsoft Azure Blob Storage container access policy that grants public, unauthenticated list and read permissions to the container holding device log files. This is a well-known Azure storage misconfiguration class where containers default to public access unless explicitly locked down. Affected CPEs - cpe:2.3:a:gardyn:gardyn_home_firmware:*:*:*:*:*:*:*:*, cpe:2.3:a:gardyn:gardyn_studio_firmware:*:*:*:*:*:*:*:*, and cpe:2.3:a:gardyn:gardyn_cloud_api:*:*:*:*:*:*:*:* - all carry wildcard version specifiers, confirming this is a cloud infrastructure misconfiguration affecting all deployed versions rather than a code defect in a specific firmware release.
RemediationAI
The primary fix is reconfiguring the Azure Blob Storage container to remove public list and read permissions, setting the container to private access and enforcing authenticated access via Azure Shared Access Signatures (SAS) or Azure Active Directory (Entra ID) role-based access control. Exact patched firmware or API versions are not independently confirmed from the data provided - consult the vendor advisory at https://mygardyn.com/security/ for fix version specifics before deploying updates. As an immediate compensating control, Gardyn device operators should assume all historical log filenames and their contents have been enumerated and rotate any device identifiers or tokens that appear in log files. Since the affected storage container is cloud-hosted, there are no effective network-level workarounds for end users - the fix must be applied at the Azure storage account configuration level by the vendor. The CISA CSAF advisory at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-183-03.json provides machine-readable remediation metadata for automated tooling.
More in Gardyn Home Firmware
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today