Gardyn Security Incident

← All CVEs in ICSA-26-055-03

CVE-2025-1242

Use of Hard-coded Credentials (Azure IoT Hub)

CVECVE-2025-1242
SeverityCritical (9.1)
Weakness (CWE)CWE-798: Use of Hard-coded Credentials
Affected componentsCloud API <2.12.2026; Mobile App <2.11.0; Firmware <master.622
VendorGardyn Inc.
Affected productsGardyn Home Kit Models 1.0, 2.0, 3.0, 4.0; Gardyn Studio Models 1.0, 2.0
SectorFood and Agriculture (CISA classification)
Status per CISA Update ARemediated
CoordinatorCERT/CC (parent case VU#653116) and CISA

What is documented

Per the researcher’s coordinated-disclosure repository, the Azure IoT Hub administrative credential (the iothubowner shared access policy) was reachable through unauthenticated API responses, the mobile application bundle, and device firmware. Per the researcher’s repository, the credential was reachable in API responses since at least May 2019, approximately six years prior to disclosure, and was retained across an IoT Hub migration.

Primary sources

Mitigation per CISA Update A

Per CISA Update A (April 2, 2026), this CVE is remediated. The fix versions stated by CISA are: Gardyn mobile application 2.11.0 or later; Gardyn cloud API 2.12.2026 or later; Home Kit firmware master.622 or later. See the CISA advisory and the how to update page.

← All CVEs in ICSA-26-055-03