CVE-2026-55726

CVE-2026-55726: Publicly Listable Azure Blob Storage Container device logs Advisory Field| Value ---|--- CVE| CVE-2026-55726 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 5.3 Medium Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Vector 4.0|...

CVE-2025-1242

CVE-2025-1242: Exposure of Administrative IoT Hub Credentials Advisory Field| Value ---|--- CVE| CVE-2025-1242 ICSA| ICSA-26-055-03 CVSS 3.1| 9.1 Critical Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-798 Use of Hard-coded Credentials Researcher| Michael Groberman — Gr0m Published...

CVE-2026-32662

CERT/CC VU653116 | CISA Advisory ICSA-26-055-03 | All CVEs | Case Repository CVE-2026-32662: Active Debug Code in Production Advisory Field| Value ---|--- CVE| CVE-2026-32662 ICSA| ICSA-26-055-03 Update A CVSS 3.1| 5.3 Medium Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE| CWE-489 Activ...

Exploit for CVE-2026-13768

CVE-2026-13768: Privileged IoT Hub Credential — Fleet Enumerat...

Gardyn Home Kit Cloud API and Gardyn Mobile Application have vulnerabilities related to trust management.

Gardyn Home Kit Cloud API and Gardyn Mobile Application are products of the American company Gardyn. Gardyn Home Kit Cloud API is an indoor hydroponic cultivation system. Gardyn Mobile Application is a mobile control application. There are security vulnerabilities in Gardyn Home Kit Cloud API and...

EUVD-2026-12159

Philips Hue Bridge HomeKit Accessory Protocol Transient Pairing Mode Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. Th...

Exploit for CVE-2025-1242

ICSA-26-055-03 — Gardyn Home Kit IoT Vulnerabilities CISA ICS...

CVE-2025-29629: Use of Default Credentials

Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for secure shell access. This may result in attackers gaining access to exposed Gardyn Home Kits...

CVE-2025-29631

Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 is vulnerable to command injection through vulnerable methods that do not sanitize input before passing content to the operating system for execution. The vulnerability m...

CVE-2025-29631: Improper Neutralization of Special Elements used in an OS Command

Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through vulnerable methods that do not sanitize input before passing content to the operating system for execution. The vulnerability may allow an...

CVE-2025-29629

Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 uses weak default credentials for secure shell access. This may result in attackers gaining access to exposed Gardyn Home Kits...

CVE-2025-29628: Improper Enforcement of Message Integrity During Transmission in a Communication Channel

A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 leaving the string vulnerable to interception and modification through a...

PT-2025-16370

Name of the Vulnerable Software and Affected Versions Ksix Zigbee smart home kit versions v1.0.3 through v1.0.12 Description A replay attack issue was discovered in the Zigbee smart home kit, where the anti-replay mechanism based on the frame counter field is improperly implemented. This allows a...

CVE-2021-27289: Authentication Bypass by Capture-replay

A replay attack vulnerability was discovered in a Zigbee smart home kit manufactured by Ksix Zigbee Gateway Module = v1.0.3, Door Sensor = v1.0.7, Motion Sensor = v1.0.12, where the Zigbee anti-replay mechanism - based on the frame counter field - is improperly implemented. As a result, an attack...