Description
Storage credentials are hardcoded in the mobile app and device firmware. These credentials do not adequately limit end user permissions and do not expire within a reasonable amount of time. This vulnerability may grant unauthorized access to production storage containers.
Published: 2026-04-03
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized access to production storage containers
Action: Apply Update
AI Analysis

Impact

Hard‑coded credentials embedded in the Gardyn mobile application and Home device firmware create a weakness that permits unauthorized authentication to Gardyn services, enabling attackers to access production storage containers. Because the credentials do not limit permissions, are not tied to a specific user, and lack an expiration policy, they expose the system to potential data theft, tampering, or service disruption.

Affected Systems

The flaw impacts Gardyn’s Cloud API, the Gardyn mobile application, and the firmware of Gardyn Home devices. Users are advised to upgrade to the latest mobile app version and to apply firmware version master.622 or newer on all home kits and studio devices.

Risk and Exploitability

With a CVSS score of 8.8, the vulnerability is rated high severity. The EPSS score is not provided and the issue is not listed in CISA’s KEV catalog, but the persistent, non‑expiring credentials increase long‑term risk. Based on the description, it is inferred that attackers could extract the credentials from the mobile app or firmware and use them remotely to reach storage containers, provided the device maintains network connectivity. The official workaround is to upgrade the software; failure to do so keeps systems exposed to unauthorized access.

Generated by OpenCVE AI on April 3, 2026 at 23:26 UTC.

Remediation

Vendor Workaround

Gardyn states that the relevant fixes are included in the latest version of the Gardyn mobile application. Users are required to run a supported version of the Gardyn App on their phone in order to access Gardyn services and devices. The current versions of the Gardyn App and the Gardyn Home firmware can be checked in the Gardyn App. For all vulnerabilities, Gardyn recommends users ensure their home kit and studio devices are upgraded to firmware master.622 or later. Gardyn also recommends that users update their mobile application to the most recent version. Gardyn requests that users ensure their devices have network connectivity in order to automatically download needed firmware updates. Unconnected devices will automatically update when configured with a working Internet connection.

OpenCVE Recommended Actions

  • Upgrade the Gardyn mobile application to the most recent version.
  • Upgrade all Gardyn Home devices to firmware master.622 or later.

Generated by OpenCVE AI on April 3, 2026 at 23:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Gardyn
Gardyn cloud Api
Gardyn mobile Application
Vendors & Products Gardyn
Gardyn cloud Api
Gardyn mobile Application

Mon, 06 Apr 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 03 Apr 2026 21:30:00 +0000

Type Values Removed Values Added
Description Storage credentials are hardcoded in the mobile app and device firmware. These credentials do not adequately limit end user permissions and do not expire within a reasonable amount of time. This vulnerability may grant unauthorized access to production storage containers.
Title Gardyn Mobile Application and Device Firmware Use Hard-coded Credentials
Weaknesses CWE-798
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L'}

cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Gardyn Cloud Api Mobile Application
cve-icon MITRE

Status: PUBLISHED

Assigner: icscert

Published:

Updated: 2026-04-06T14:39:20.062Z

Reserved: 2025-09-18T11:58:39.111Z

Link: CVE-2025-10681

cve-icon Vulnrichment

Updated: 2026-04-06T14:39:01.903Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-04-03T21:17:08.630

Modified: 2026-04-07T13:20:55.200

Link: CVE-2025-10681

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-06T22:22:20Z

Weaknesses