🔐 CVE Alert

CVE-2026-54477

MEDIUM 5.4

Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax

CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th

The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks.

CWE CWE-644
Vendor gardyn
Product gardyn home firmware
Published Jul 2, 2026
Stay Ahead of the Next One

Get instant alerts for gardyn gardyn home firmware

Be the first to know when new medium vulnerabilities affecting gardyn gardyn home firmware are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Affected Versions

Gardyn / Gardyn Home Firmware
0 < master.627
Gardyn / Gardyn Studio Firmware
0 < master.627
Gardyn / Gardyn Cloud API
0 < 2.12.2026

References

NVD ↗ CVE.org ↗ EPSS Data ↗
mygardyn.com: https://mygardyn.com/security/ cisa.gov: https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-03 github.com: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-183-03.json

Credits

Michael Groberman reported this vulnerability to CISA.