PT-2026-55338 · Gardyn · Gardyn Studio+1

Published 2026-07-02 · Updated 2026-07-03 · CVE-2026-13768

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Gardyn Home Kit and Studio devices (affected versions not specified)

Description A hardcoded iothubowner key in the IoT Hub allows unauthenticated attackers to invoke the IoTHub Registry Manager function. This action exposes connection information for all connected devices and enables the execution of arbitrary commands on specific devices. Furthermore, this access may allow an attacker to pivot to other devices within the user's local network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2026-13768

Affected Products

Gardyn Home Kit

Gardyn Studio

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-13768 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-183-03.json · Note
• https://twitter.com/0J0BIT/status/2072775088097603851 · Twitter Post
• https://mygardyn.com/security · Note
• https://cisa.gov/news-events/ics-advisories/icsa-26-183-03 · Note