VULNERABILITY INTELLIGENCE

CVE-2026-13768

CVSS score9.5 CRITICAL
EPSS probability0.65%
CISA KEVNot currently listed
Published2026-07-03
Last modified2026-07-06
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Description

Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key also allows a malicious user to execute arbitrary commands on a specific connected device and may allow the malicious user to pivot to other devices on the user's network.

Weakness classification

  • CWE-798: Use of Hard-coded Credentials

Primary references