CRITICAL CWE-798
CVE-2026-13768
Gardyn IoT Hub Use of Hard-coded Credentials
Gardyn·Home Firmware
10.0/ 10
CVSS 3.1
Critical severity
0.65%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 52% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list.
Timeline
- Published
- Jul 2, 2026
- Updated
- Jul 6, 2026
- First covered
- Jul 3, 2026
- Latest story
- 4 months ago
Summary
Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key also allows a malicious user to execute arbitrary commands on a specific connected device and may allow the malicious user to pivot to other devices on the user's network.
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityLow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:LAffected products
- Gardyn Home Firmwarebefore master.627
- Gardyn Studio Firmwarebefore master.627
- Gardyn Cloud APIbefore 2.12.2026