CVE-2025-29629

CRITICAL 9.1

CVSS Score

9.1

EPSS Score

0.0%

EPSS Percentile

0th

Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for secure shell access. This may result in attackers gaining access to exposed Gardyn Home Kits.

CWE	CWE-1392
Vendor	gardyn
Product	home kit firmware
Published	Jul 25, 2025
Last Updated	Feb 25, 2026

Stay Ahead of the Next One

Get instant alerts for gardyn home kit firmware

Be the first to know when new critical vulnerabilities affecting gardyn home kit firmware are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Gardyn / Home Kit Firmware

0 < master.619

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/mselbrede/gardyn/blob/main/CVE-2025-29629.md cisa.gov: https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03 mygardyn.com: https://mygardyn.com/blog/security-update/