CVE-2025-1242

CRITICAL 9.1

Administrative Credentials Can Be Extracted Through Gardyn API Responses

CVSS Score

9.1

EPSS Score

0.0%

EPSS Percentile

0th

The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub exposing connected devices to malicious control.

CWE	CWE-798
Vendor	gardyn
Product	home kit
Published	Feb 25, 2026
Last Updated	Feb 25, 2026

Stay Ahead of the Next One

Get instant alerts for gardyn home kit

Be the first to know when new critical vulnerabilities affecting gardyn home kit are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

Gardyn / Home Kit

0 < master.619

Gardyn / Home Kit Mobile Application

0 < 2.11.0

Gardyn / Home Kit Cloud API

0 < 2.12.2026

References

NVD ↗ CVE.org ↗ EPSS Data ↗

mygardyn.com: https://mygardyn.com/security/ cisa.gov: https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03 github.com: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-055-03.json

Credits

Michael Groberman reported this vulnerability to CISA.