Gardyn vulnerabilities
We track 6 vulnerabilities in Gardyn products across 9 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on July 3, 2026.
Latest Gardyn vulnerabilities
- 10.0 Critical severity
Gardyn Home Firmware: Use of Hard-coded Credentials
Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key also allows a m
- 8.6 High severity
Mobile Application: Use of Hard-coded Credentials
Storage credentials are hardcoded in the mobile app and device firmware. These credentials do not adequately limit end user permissions and do not expire within a reasonable amount of time. This vulnerability may grant unauthorized access to production storage
- 9.1 Critical severity
Home Kit: Use of Hard-coded Credentials
The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub
- 9.8 Critical severity
Home Kit Firmware: Improper Neutralization of Special Elements used in an OS Command
Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through vulnerable methods that do not sanitize input before passing content to the operating system for exec
- 9.1 Critical severity
Home Kit Firmware: Use of Default Credentials
Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for secure shell access. This may result in attackers gaining access to exposed Gardyn Home Kits.
- 9.4 Critical severity
Home Kit Firmware: Improper Enforcement of Message Integrity During Transmission in a Communication Channel
A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 leaving the string vulnerable to intercept