View CSAF
Summary
Successful exploitation of these vulnerabilities could allow unauthenticated users to access and control edge devices, access cloud-based devices and user information without authentication, and pivot to other edge devices managed in the Gardyn cloud environment.
The following versions of Gardyn Home Kit are affected:
Home Kit Firmware
Gardyn Home Kit Mobile Application <2.11.0 (CVE-2025-29628, CVE-2025-29629, CVE-2025-29631, CVE-2025-1242)
Gardyn Home Kit Cloud API <2.12.2026 (CVE-2025-29628, CVE-2025-29629, CVE-2025-29631, CVE-2025-1242)
CVSS
Vendor
Equipment
Vulnerabilities
v3 9.1
Gardyn
Gardyn Home Kit
Cleartext Transmission of Sensitive Information, Use of Default Credentials, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Use of Hard-coded Credentials
Background
Critical Infrastructure Sectors: Food and Agriculture
Countries/Areas Deployed: United States
Company Headquarters Location: United States
Vulnerabilities
Expand All +
CVE-2025-29628
A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection leaving the string vulnerable to interception and modification through a Man-in-the-Middle attack. This may result in the attacker capturing device credentials or taking control of vulnerable home kits.
View CVE Details
Affected Products
Gardyn Home Kit
Vendor: Gardy...