PT-2026-21920 · Gardyn · Gardyn Iot Hub

Published 2026-02-25 · Updated 2026-04-22 · CVE-2025-1242

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Gardyn IoT Hub (affected versions not specified)

Description Administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. This exposure may allow an attacker to gain full administrative access to the Gardyn IoT Hub, potentially exposing connected devices to malicious control. The vulnerability allows an attacker to extract administrative credentials via multiple attack vectors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-1242

Affected Products

Gardyn Iot Hub

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-1242 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-055-03.json · Note
• https://cisa.gov/news-events/ics-advisories/icsa-26-055-03 · Note
• https://t.me/CVEtracker/45741 · Telegram Post
• https://t.me/cveNotify/153472 · Telegram Post
• https://mygardyn.com/security · Note
• https://twitter.com/TheHackerWire/status/2026717585753124949 · Twitter Post
• https://twitter.com/CveTodo/status/2026698274179043372 · Twitter Post
• https://twitter.com/cracbot/status/2028425262262833489 · Twitter Post
• https://twitter.com/CVEnew/status/2027744282061205565 · Twitter Post
• https://twitter.com/0dayPublishing/status/2047015057276514321 · Twitter Post
• https://twitter.com/ThreatSynop/status/2027290227526484045 · Twitter Post