CVE-2025-10681

HIGH 8.6

Gardyn Mobile Application and Device Firmware Use Hard-coded Credentials

CVSS Score

8.6

EPSS Score

0.0%

EPSS Percentile

12th

Storage credentials are hardcoded in the mobile app and device firmware. These credentials do not adequately limit end user permissions and do not expire within a reasonable amount of time. This vulnerability may grant unauthorized access to production storage containers.

CWE	CWE-798
Vendor	gardyn
Product	mobile application
Published	Apr 3, 2026
Last Updated	Apr 6, 2026

Stay Ahead of the Next One

Get instant alerts for gardyn mobile application

Be the first to know when new high vulnerabilities affecting gardyn mobile application are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Affected Versions

Gardyn / Mobile Application

0 < 2.11.0

Gardyn / Cloud API

0 < 2.12.2026

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cisa.gov: https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03 mygardyn.com: https://mygardyn.com/security/ github.com: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-055-03.json

Credits

Michael Groberman reported these vulnerabilities to CISA.