Gardyn Security Incident

For Researchers

Technical materials related to CISA advisories ICSA-26-055-03 (Update B) and ICSA-26-183-03 (Gardyn IoT Hub) and the thirteen CVEs across the two.

Disclosure repositories

Main advisory repositorygithub.com/MichaelAdamGroberman/ICSA-26-055-03
Companion advisory repository (Gardyn IoT Hub)github.com/MichaelAdamGroberman/ICSA-26-183-03
CERT/CC parent casegithub.com/MichaelAdamGroberman/VU653116

Per-CVE repositories

Companion advisory ICSA-26-183-03 (Gardyn IoT Hub) — per-CVE repositories

Endpoints documented as not requiring authentication

Per CISA advisory ICSA-26-055-03 (Update A), the absence of authentication is documented as a property of multiple endpoints across customer, administrative, and dev/test scopes:

CVEEndpoint or scopeFunctionCVSS
CVE-2026-28766/api/usersCustomer-facing data (approximately 134,215 records)9.3
CVE-2026-32646/api/admin/devicesAdministrative function (device enumeration and management)7.5
CVE-2026-28767/api/admin/notificationsAdministrative function (notification system)5.3
CVE-2026-32662Development and test endpoints (multiple paths)Dev/test endpoints reachable in production5.3

Per the same advisory, separate findings document hardcoded administrative credentials (CVE-2025-1242, CVSS 9.1) and a hardcoded Azure Blob Storage account key (CVE-2025-10681, CVSS 8.6), as well as default credentials enabling SSH access to the device platform (CVE-2025-29629, CVSS 8.3) and cleartext transmission of an IoT Hub connection string (CVE-2025-29628, CVSS 8.3). Per the CISA advisory, the lack of authentication or authorization controls is documented across customer, administrative, dev/test, device-platform SSH, and infrastructure-credential scopes.

Detectability of access during the exposure window

Per the maintainer’s coordinated-disclosure repository, no authentication-level access logging existed on the affected endpoints during the exposure window; this is sourced to coordinated-disclosure correspondence and to a 2026-01-27 Gardyn customer-support response to a Personal Information Access Request, not to the CISA advisory text. As a forensic matter, when no access logging exists on an endpoint, unauthenticated access to that endpoint during the unlogged window is not observable in the vendor’s logs. Statements about whether unauthorized access did or did not occur during the exposure window are bounded by the existence of access logging at the time.

Attack chains — proof-of-concept (remediated)

Per the maintainer’s repository and the CISA advisories, individual CVEs combine into documented chains. Each chain below is shown as its node graph — which CVEs combine and the resulting impact — without exploitation detail. Every CVE referenced was remediated: per CISA ICSA-26-055-03 Update A, the ten CVEs in that advisory; and per CISA ICSA-26-183-03, Gardyn states the IoT Hub deployed infrastructure has been updated. Proof-of-concept and reproduction detail are not reproduced on this page; where a public PoC exists it is linked from each chain and remains in the per-CVE repository.

  1. Chain 1 — unauthenticated remote root Remediated
    CVE-2025-1242 → CVE-2025-29631 ⇒ remote code execution as root on registered devices (138,160+)

    Nodes: hardcoded iothubowner credential → command injection in upgrade(). Impact per the maintainer’s repository.

    PoC CVE-2025-1242 repository; prior work by mselbrede/gardyn (command injection, July 2025). Reproduction steps hosted off-site.

  2. Chain 2 — mass PII exposure Remediated
    CVE-2026-28766 → CVE-2026-25197 ⇒ PII access for 134,215 user records

    Nodes: unauthenticated /api/users → IDOR on /api/user/{id} with sequential integer ids. Per the maintainer’s repository, exposed fields include names, email addresses, phone numbers, and a partial payment-card field (last_four) — not full card number or CVV.

    PoC CVE-2026-28766 repository, CVE-2026-25197 repository. Reproduction steps hosted off-site.

  3. Chain 3 — IoT Hub control plane Remediated
    CVE-2026-13768 CVSS 10.0 ⇒ fleet enumeration → device access and control → pivot to other managed edge devices

    Node: privileged IoT Hub credential (companion advisory ICSA-26-183-03). Per the CISA advisory, the chain yields fleet enumeration and device control across the Gardyn cloud environment. Per the maintainer’s repository, this is the control-plane blast radius of Chain 1.

    PoC CVE-2026-13768 repository. Reproduction steps hosted off-site.

Prior work

Per the maintainer’s repository, CVE-2025-29628, CVE-2025-29629, and CVE-2025-29631 were originally disclosed by mselbrede in February 2025, with technical details and a proof-of-concept published in July 2025.

Other references

Contact

See the contact page. PGP and Signal available.