CVE-2025-1242

CRITICAL

Gardyn Home Kit - Use of Hard-coded Credentials

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2025-1242. PoCs published by MichaelAdamGroberman.

AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2025-1242, which involves the exposure of Azure IoT Hub administrative credentials in Gardyn IoT devices. The writeup includes exposure vectors, impact assessment, and remediation steps, demonstrating a deep understanding of the vulnerability.

Description

The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub exposing connected devices to malicious control.

Exploits (2)

nomisec WRITEUP
by MichaelAdamGroberman · poc
https://github.com/MichaelAdamGroberman/CVE-2025-1242

This repository provides a detailed technical analysis of CVE-2025-1242, which involves the exposure of Azure IoT Hub administrative credentials in Gardyn IoT devices. The writeup includes exposure vectors, impact assessment, and remediation steps, demonstrating a deep understanding of the vulnerability.

Classification
Writeup 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Gardyn Home Kit 1.0, 2.0, 3.0; Gardyn Studio 1.0, 2.0 (Firmware < master.619, Mobile App < 2.11.0, Cloud API < 2.12.2026)
No auth needed
Prerequisites: Access to unauthenticated API endpoints or mobile application
devstral-2 · analyzed Feb 28, 2026 Full analysis →
nomisec WRITEUP
by MichaelAdamGroberman · poc
https://github.com/MichaelAdamGroberman/ICSA-26-055-03

This repository contains a detailed technical analysis of CVE-2025-1242, focusing on the exposure of administrative IoT Hub credentials in Gardyn's systems. It includes vulnerability details, exposure vectors, and remediation steps, demonstrating a deep understanding of the issue.

Classification
Writeup 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Gardyn Home Kit 1.0, 2.0, 3.0; Gardyn Studio 1.0, 2.0
No auth needed
Prerequisites: Access to unauthenticated API endpoints or reverse-engineered mobile application
devstral-2 · analyzed Feb 28, 2026 Full analysis →

Scores

CVSS v3 9.1
EPSS 0.0044
EPSS Percentile 34.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-798
Status published
Products (3)
Gardyn/Home Kit < master.619
Gardyn/Home Kit Cloud API < 2.12.2026
Gardyn/Home Kit Mobile Application < 2.11.0
Published Feb 25, 2026
Tracked Since Feb 25, 2026