PT-2025-30897 · Gardyn · Gardyn 4

Mselbrede · Published 2025-07-25 · Updated 2026-02-25 · CVE-2025-29629

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Gardyn Home Kit firmware versions prior to master.619 Gardyn Home Kit Mobile Application versions prior to 2.11.0 Gardyn Home Kit Cloud API versions prior to 2.12.2026 Gardyn versions prior to 4

Description The Gardyn Home Kit firmware, Mobile Application, and Cloud API use weak default credentials for secure shell access. This could allow attackers to gain access to exposed Gardyn Home Kits. An issue in Gardyn allows a remote attacker to obtain sensitive information and execute arbitrary code through the Gardyn Home component.

Recommendations Update Gardyn Home Kit firmware to version master.619 or later. Update Gardyn Home Kit Mobile Application to version 2.11.0 or later. Update Gardyn Home Kit Cloud API to version 2.12.2026 or later. Update Gardyn to version 4 or later.

Exploit

Fix

RCE

Information Disclosure

Code Injection

Weakness Enumeration

CWE-200

CWE-94

CWE-1392

Related Identifiers

CVE-2025-29629

Affected Products

Gardyn 4

References · 9

• 🔥 https://github.com/mselbrede/gardyn/blob/main/CVE-2025-29629.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-29629 · Security Note
• https://mygardyn.com/blog/security-update · Note
• https://t.me/cveNotify/153256 · Telegram Post
• http://gardyn.com · Note
• https://cisa.gov/news-events/ics-advisories/icsa-26-055-03 · Note
• https://twitter.com/cracbot/status/1950511769182482773 · Twitter Post
• https://twitter.com/CVEnew/status/1948794750724968875 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1948900220583993752 · Twitter Post