Product
6 published CVES affecting Gardyn Cloud API, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
Newest publication first
Storage credentials are hardcoded in the mobile app and device firmware. These credentials do not adequately limit end user permissions and do not expire within a reasonable amount of time. This vulnerability may grant unauthorized access to production storage containers.
A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.
A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.
A specific administrative endpoint notifications is accessible without proper authentication.
A specific administrative endpoint is accessible without proper authentication, exposing device management functions.
Development and test API endpoints are present that mirror production functionality.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.