LIVE FEED

Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiperHardening a Personal Linux Server in an AfternoonMicrosoft 365 outage disrupts Outlook, Teams, and Copilot worldwideCheck Point patches zero-day root escalation flaw exploited against customersHackers Compromise 4,800 GitHub Accounts to Steal Cloud CredentialsHow to Put a Self-Hosted Service Behind SSO and Intrusion Blocking in an AfternoonBaker Tilly notifies clients of data breach at third-party provider

MEDIUM CWE-644

CVE-2026-54477

Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax

Gardyn·Home Firmware

5.4/ 10

CVSS 3.1

Medium severity

0.33%

EPSS exploit odds

Chance of exploitation in the next 30 days

Higher than 26% of all CVEs

Not listed

CISA KEV catalog

No confirmed in-the-wild exploitation on CISA's list.

Timeline

Published: Jul 2, 2026
Updated: Jul 6, 2026
First covered: Jul 3, 2026
Latest story: 4 months ago

Summary

The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks.

Attack profile

Attack vectorNetwork

ComplexityLow

PrivilegesNone

User interactionRequired

ScopeUnchanged

ConfidentialityLow

IntegrityLow

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected products

Gardyn Home Firmwarebefore master.627
Gardyn Studio Firmwarebefore master.627
Gardyn Cloud APIbefore 2.12.2026

References

CVE.org recordcve.org NVD entrynvd.nist.gov Advisorymygardyn.com Advisorycisa.gov Advisorygithub.com