CISA 2026-07-02

Gardyn IoT Hub

Machine-generated analysis · WAYSCloud LLM

The advisory states that unauthenticated access to the iothubowner key could allow full control over managed devices and execution of arbitrary commands on connected devices.

Context

Gardyn IoT Hub is a system managing connected devices for home and studio environments, as indicated by the affected firmware versions. The advisory identifies three vulnerabilities involving hard-coded credentials, exposure of sensitive information, and improper neutralization of HTTP headers, which upstream could allow unauthenticated users to access device connection information and execute arbitrary commands. Notably, the vendor reports that deployed infrastructure has already been updated to address these issues. The product is reportedly used in the Food and Agriculture sector and is deployed in the United States.

Operator considerations

- Check: Verify that Gardyn Home and Studio devices are running firmware version master.627 or later and Cloud API version 2.12.2026 or later via the Gardyn mobile application.
- Patch: Ensure devices have Internet connectivity to receive automatic firmware updates; update the Gardyn mobile application to the latest version.
- Log: Monitor for unexpected changes in device behavior or unauthorized command execution if devices were previously offline during the update window.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of these vulnerabilities could allow unauthenticated users to access and control IoT Hub managed devices.

The following versions of Gardyn IoT Hub are affected:

Home Firmware

Studio Firmware

Cloud API

Read the full advisory on CISA →