by Kastro
Paper/Archive/CVE-2025-1242

CVE-2025-1242

Gardyn Home Kit — Administrative Credentials Can Be Extracted Through Gardyn API Responses

EPSS 0.6%CVSS 9.3
critical.is priorityof 100
37
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 47.5.475 × 209.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub exposing connected devices to malicious control.

Affected

ProductAffectedFixed inSource
Home Kit< master.619master.619CNA
Home Kit Mobile Application< 2.11.02.11.0CNA
Home Kit Cloud API< 2.12.20262.12.2026CNA

Scores by source

icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
icscert (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refmygardyn.com/securityrefcisa.gov/news-events/ics-advisories/icsa-26-055-03refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-055-03.json