Home Kit Firmware vulnerabilities

3 known vulnerabilities in Home Kit Firmware from Gardyn. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Home Kit Firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-29631Jul 25, 2025GardynEPSS 2.1%

  Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through vulnerable methods that do not sanitize input before passing content to the operating system for exec

• 9.1 Critical severity

  Home Kit Firmware: Use of Default Credentials

  CVE-2025-29629Jul 25, 2025Gardyn

  Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for secure shell access. This may result in attackers gaining access to exposed Gardyn Home Kits.

• 9.4 Critical severity

  Home Kit Firmware: Improper Enforcement of Message Integrity During Transmission in a Communication Channel

  CVE-2025-29628Jul 25, 2025Gardyn

  A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 leaving the string vulnerable to intercept