CISA Advisories ICSA-26-055-03 and ICSA-26-183-03

Thirteen CVEs across two CISA advisories affecting the Gardyn IoT platform: ICSA-26-055-03 (ten CVEs, as updated July 2, 2026, Update B) and the companion advisory ICSA-26-183-03 (Gardyn IoT Hub, three CVEs, published July 2, 2026). Each entry links to the canonical NVD record, MITRE CVE record, and per-CVE researcher repository where available.

The advisory

Revision history of ICSA-26-055-03

Per the CISA CSAF record for ICSA-26-055-03, the advisory has three published revisions. Change summaries below are quoted from CISA’s own revision-history entries.

Per the maintainer’s coordinated-disclosure repository, Update B did not add or remove CVEs; the CVE set for ICSA-26-055-03 remains the ten listed below. The per-CVE affected-firmware ceiling remains <master.622 in the advisory’s per-vulnerability product data. The three CVEs published the same day are in the separate companion advisory ICSA-26-183-03.

The ten CVEs in ICSA-26-055-03

Companion advisory: ICSA-26-183-03 (Gardyn IoT Hub)

Per CISA advisory ICSA-26-183-03, published July 2, 2026 (the same day as ICSA-26-055-03 Update B), three additional CVEs affect the Gardyn IoT Hub deployed infrastructure. Per the CSAF record, the advisory carries a headline CVSS v3 score of 10.0 (its highest-rated CVE, CVE-2026-13768) and, per CISA, no known public exploitation had been reported at publication.

Per the CISA advisory, affected versions are Gardyn Home and Studio firmware <master.627 and Cloud API <2.12.2026. Per CISA, Gardyn states that the IoT Hub deployed infrastructure has been updated to fix the listed vulnerabilities.

Endpoints documented as not requiring authentication

Per CISA advisory ICSA-26-055-03 (Update A), the absence of authentication is documented across multiple endpoint categories spanning customer-facing data, administrative functions, and development/test endpoints:

• CVE-2026-28766 — /api/users (customer-facing data, approximately 134,215 records, CVSS 9.3)
• CVE-2026-32646 — /api/admin/devices (administrative function, CVSS 7.5)
• CVE-2026-28767 — /api/admin/notifications (administrative function, CVSS 5.3)
• CVE-2026-32662 — development/test endpoints reachable in production (CVSS 5.3)

Per the CISA advisory, the lack of authentication is documented as a property of multiple endpoints rather than an isolated finding.

Detectability of access during the exposure window

Per the maintainer’s coordinated-disclosure repository, no authentication-level access logging existed on the affected endpoints during the exposure window; this is sourced to coordinated-disclosure correspondence and to a 2026-01-27 Gardyn customer-support response to a Personal Information Access Request, not to the CISA advisory text. When no access logging exists on an endpoint, unauthenticated access to that endpoint during the unlogged window is not observable in the vendor’s logs. See vendor public statements Item 9.

Attack chains — proof-of-concept (remediated)

Per the maintainer’s repository and the CISA advisories, individual CVEs combine into documented chains. Each chain below is shown as its node graph — which CVEs combine and the resulting impact — without exploitation detail. Every CVE referenced was remediated: per CISA ICSA-26-055-03 Update A, the ten CVEs in that advisory; and per CISA ICSA-26-183-03, Gardyn states the IoT Hub deployed infrastructure has been updated. Proof-of-concept and reproduction detail are not reproduced on this page; where a public PoC exists it is linked from each chain and remains in the per-CVE repository.

1. Chain 1 — unauthenticated remote root Remediated
   CVE-2025-1242 → CVE-2025-29631 ⇒ remote code execution as root on registered devices (138,160+)

   Nodes: hardcoded iothubowner credential → command injection in upgrade(). Impact per the maintainer’s repository.

   PoC CVE-2025-1242 repository; prior work by mselbrede/gardyn (command injection, July 2025). Reproduction steps hosted off-site.

2. Chain 2 — mass PII exposure Remediated
   CVE-2026-28766 → CVE-2026-25197 ⇒ PII access for 134,215 user records

   Nodes: unauthenticated /api/users → IDOR on /api/user/{id}. Per the maintainer’s repository, exposed fields include names, email addresses, phone numbers, and a partial payment-card field (last_four) — not full card number or CVV.

   PoC CVE-2026-28766 repository, CVE-2026-25197 repository. Reproduction steps hosted off-site.

3. Chain 3 — IoT Hub control plane Remediated
   CVE-2026-13768 CVSS 10.0 ⇒ fleet enumeration → device access and control → pivot to other managed edge devices

   Node: privileged IoT Hub credential (companion advisory ICSA-26-183-03). Per the CISA advisory, the chain yields fleet enumeration and device control across the Gardyn cloud environment. Per the maintainer’s repository, this is the control-plane blast radius of Chain 1.

   PoC CVE-2026-13768 repository. Reproduction steps hosted off-site.

Per the maintainer’s repository, additional findings disclosed under CERT/CC VU#653116 remain under coordination and are not enumerated here; only CVEs published by CISA are listed.

Disclosure timeline

Per the maintainer’s coordinated-disclosure repository, initial private vendor disclosure was on October 14, 2025, made by Michael Groberman in his self-identified capacity as a Gardyn customer with technical knowledge; CERT/CC was engaged on December 11, 2025 as an escalation after vendor silence. CISA published the initial advisory on February 24, 2026 with four CVEs, Update A on April 2, 2026 expanding to ten CVEs, and Update B on July 2, 2026 (firmware version numbers adjusted and recommended user action changed, with the CVE set unchanged at ten). On the same day, CISA published the separate companion advisory ICSA-26-183-03 (Gardyn IoT Hub) with three further CVEs. See the full timeline and the coordinated disclosure process.

Primary sources

• CISA ICSA-26-055-03 (advisory, Update A, and Update B)
• CSAF JSON for ICSA-26-055-03 (CISA)
• CISA ICSA-26-183-03 (Gardyn IoT Hub companion advisory)
• CSAF JSON for ICSA-26-183-03 (CISA)
• Maintainer repository (per-CVE writeups)
• CERT/CC VU#653116 record
• NVD and MITRE CVE: linked from each per-CVE page