CVE-2026-13768
Critical
Description
Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key also allows a malicious user to execute arbitrary commands on a specific connected device and may allow the malicious user to pivot to other devices on the user's network.
SeverityCritical
CVSS10.0
Exploit probability—
ProductGardyn Home Firmware
PublishedJul 3, 2026
First seenJul 3, 2026
Weakness typeCWE-798Hard-coded credentials
How to fix
Update
- Gardyn Gardyn Home Firmwaremaster.627 or later
- Gardyn Gardyn Studio Firmwaremaster.627 or later
- Gardyn Gardyn Cloud API2.12.2026 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Gardyn Gardyn Home Firmware | v < master.627 | master.627 |
| Gardyn Gardyn Studio Firmware | v < master.627 | master.627 |
| Gardyn Gardyn Cloud API | v < 2.12.2026 | 2.12.2026 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.