CVE-2026-13768 — Gardyn IoT Hub Use of Hard-coded Credentials
Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection informa…
Published: 2026-07-02 · CVSS: 9.5 · CVSS 4.0
Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key also allows a malicious user to execute arbitrary commands on a specific connected device and may allow the malicious user to pivot to other devices on the user's network.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7