Michael Groberman

**Name of the Vulnerable Software and Affected Versions** Gardyn Home Kit and Studio devices (affected versions not specified) Gardyn IoT Hub (affected versions not specified) **Description** Gardyn devices and the associated IoT Hub cloud service expose a hardcoded privileged `iothubowner` key. An unauthenticated attacker can use this key to invoke an IoTHub Registry Manager function to retrieve connection information for all Gardyn Home Kit and Studio devices. Furthermore, this access allows the execution of arbitrary commands on specific connected devices and may enable the attacker to pivot to other devices within the user's local network. **Recommendations** Ensure the Gardyn app and device are updated to the most current version. Place smart devices on a separate guest or IoT WiFi network to prevent a compromised device from accessing other devices on the home network.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The admin panel lacks standard security headers, which allows for clickjacking and cross-site scripting attacks. Clickjacking is a technique where a user is tricked into clicking a hidden element, while cross-site scripting involves injecting malicious scripts into web pages viewed by other users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gardyn (affected versions not specified) **Description** An Azure Blob Storage container used for storing device logs is configured to be publicly listable without authentication. This allows an unauthorized user to access any device log file stored within the container. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions versions (affected versions not specified) Description An authenticated user can access other user profiles by manipulating the `id` number within an API call. This occurs through a specific API endpoint. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A specific administrative endpoint 'notifications' is accessible without proper authentication. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions Gardyn (affected versions not specified) Description A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A specific administrative endpoint is accessible without proper authentication, which exposes device management functions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined. (affected versions not specified) **Description** Development and test API endpoints are present that mirror production functionality, potentially exposing internal logic or data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.