CVE-2026-13768

Name of the Vulnerable Software and Affected Versions Gardyn Home Kit and Studio devices (affected versions not specified) Gardyn IoT Hub (affected versions not specified)

Description Gardyn devices and the associated IoT Hub cloud service expose a hardcoded privileged iothubowner key. An unauthenticated attacker can use this key to invoke an IoTHub Registry Manager function to retrieve connection information for all Gardyn Home Kit and Studio devices. Furthermore, this access allows the execution of arbitrary commands on specific connected devices and may enable the attacker to pivot to other devices within the user's local network.

Recommendations Ensure the Gardyn app and device are updated to the most current version. Place smart devices on a separate guest or IoT WiFi network to prevent a compromised device from accessing other devices on the home network.