The vulnerability allows an attacker to retrieve administrative credentials through Gardyn API responses, or by reverse engineering the mobile application or device firmware. The weakness is a hard‑coded credential scenario, classified as CWE‑798. Discovery of these credentials grants an attacker full administrative access to the Gardyn IoT Hub, which in turn enables malicious control over all connected devices, posing significant confidentiality, integrity, and availability risks.

The affected products include Gardyn Home Kit devices, Gardyn Home Kit Cloud API, and Gardyn Home Kit Mobile Application. All current firmware versions prior to the master.619 release and any mobile app releases older than the latest version are vulnerable.

The CVSS score of 9.3 indicates a severe impact. The EPSS score of less than 1% suggests the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via API requests or by reverse engineering the application or firmware, enabling an adversary to extract credentials without direct physical access.