CVE-2026-13768
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Gardyn devices expose a privileged iothubowner key. Access to this key allows an attacker to invoke the IoTHub Registry Manager function, which returns connection information for all Gardyn Home Kit and Studio devices. Additionally, the key enables arbitrary command execution on a specific connected device and may allow pivoting to other devices on the user's network.
Risk Assessment
The risk includes unauthorized access to sensitive configuration data of all Gardyn devices, remote code execution on a selected device, and potential lateral movement to other devices on the user's local network.
Recommendation
Immediately revoke access to the iothubowner key, replace it with a new one, and implement access control restrictions for the IoTHub Registry Manager. Also, update Gardyn device firmware to the latest version.
Original NVD description (English source)
Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key also allows a malicious user to execute arbitrary commands on a specific connected device and may allow the malicious user to pivot to other devices on the user's network.