Gardyn Home Kit Cloud API vulnerabilities

Latest Gardyn Home Kit Cloud API CVEs

Newest publication first

1. CVE-2025-1242 Administrative Credentials Can Be Extracted Through Gardyn API Responses

   Published 2026-02-25

   Critical·CVSS 9.3 EPSS 0.58%

   The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub exposing connected d...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.