CVE-2025-1242
Critical
Description
The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub exposing connected devices to malicious control.
SeverityCritical
CVSS9.1
Exploit probability—
ProductHome Kit
PublishedFeb 25, 2026
First seenFeb 25, 2026
Weakness typeCWE-798Hard-coded credentials
How to fix
Update
- Gardyn Home Kitmaster.619 or later
- Gardyn Home Kit Mobile Application2.11.0 or later
- Gardyn Home Kit Cloud API2.12.2026 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Gardyn Home Kit | v < master.619 | master.619 |
| Gardyn Home Kit Mobile Application | v < 2.11.0 | 2.11.0 |
| Gardyn Home Kit Cloud API | v < 2.12.2026 | 2.12.2026 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.