What’s Vulnerable › Vulnerabilities

CVE-2025-1242: Administrative Credentials Can Be Extracted Through Gardyn API Responses

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-25 · updated 2026-06-17
• Weakness: CWE-798

Description

The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub exposing connected devices to malicious control.

Affected products

• Gardyn Home Kit: before master.619 — fixed in master.619
• Gardyn Home Kit Cloud API: before 2.12.2026 — fixed in 2.12.2026
• Gardyn Home Kit Mobile Application: before 2.11.0 — fixed in 2.11.0

How to fix

Upgrade to a fixed version: Gardyn Home Kit master.619; Gardyn Home Kit Cloud API 2.12.2026; Gardyn Home Kit Mobile Application 2.11.0. Check the vendor advisory for mitigations.

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-055-03.json
• https://mygardyn.com/security/
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03

Get alerted when CVE-2025-1242 or the next vulnerability affects your stack