Gardyn IoT Hub flaws expose smart gardens
Three vulnerabilities in Gardyn IoT Hub allow unauthenticated attackers to remotely control connected smart garden devices and access logs via hardcoded credentials and cloud misconfigurations.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA has disclosed three vulnerabilities affecting Gardyn IoT Hub devices used in smart indoor gardening systems. The most severe flaw (CVE-2026-13768) involves a hardcoded privileged key that enables unauthenticated attackers to retrieve connection information for all Gardyn Home Kit and Studio devices, execute arbitrary commands on connected devices, and potentially pivot to other devices on users' networks. A second vulnerability (CVE-2026-55726) exposes device logs through a publicly accessible Azure Blob Storage container without authentication. The third issue (CVE-2026-54477) involves missing security headers in the admin panel, enabling clickjacking and cross-site scripting attacks.
Gardyn has deployed infrastructure updates to address these vulnerabilities and is pushing automatic firmware updates to connected devices. Users are advised to ensure their devices maintain internet connectivity to receive the updates and to update their mobile applications to the latest version. The vulnerabilities affect Gardyn Home Firmware versions before master.627, Studio Firmware before master.627, and Cloud API versions before 2.12.2026. CISA reports no known public exploitation at this time, but the combination of hardcoded credentials and remote command execution capabilities presents significant risk to affected users in the food and agriculture sector.
Mentioned in this report
Detection guidance
Unauthenticated Remote Command Execution Request to IoT Hub Device Management Endpoint
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects inbound API calls invoking device command/administration operations on an IoT hub management endpoint without an associated authenticated user session, consistent with abuse of a hardcoded key to issue arbitrary commands to connected devices. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated Device Command Execution via IoT Hub API
id: da4160f9-302d-5612-b423-6be08d96a237
status: experimental
description: Detects HTTP requests to an IoT device management/administration API
endpoint that invoke command execution operations (e.g. device control, reboot,
configuration push) while lacking normal per-user session authentication headers,
consistent with exploitation of a hardcoded privileged key to remotely command connected
IoT devices.
references:
- CISA advisory on Gardyn IoT Hub vulnerabilities (CVE-2026-13768)
logsource:
category: proxy
detection:
selection:
c-uri|contains:
- /device/command
- /hub/execute
- /device/control
no_session:
cs-cookie: null
condition: selection and no_session
falsepositives:
- Legitimate backend microservices calling internal device command APIs without browser
session cookies by design
- Automated firmware update or health-check jobs invoking device control endpoints
on a schedule
level: high
tags:
- attack.t1609
- attack.execution
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-03
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs