IoT Device Vulnerability in Gardyn Products
CVE-2026-13768

9.5CRITICAL

Key Information:

Vendor

Gardyn

Status
Gardyn Home Firmware
Gardyn Studio Firmware
Gardyn Cloud Api
Vendor
CVE Published:
2 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-13768?

Gardyn devices are susceptible to a severe security flaw that exposes a privileged iothubowner key. This key grants malicious users the ability to manipulate the IoTHub Registry Manager, potentially revealing critical connection information for all connected Gardyn Home Kit and Studio devices. Furthermore, exploitation of this vulnerability could enable attackers to execute arbitrary commands on specific devices, creating pathways for lateral movement across the user's network and compromising additional systems.

Affected Version(s)

Gardyn Cloud API 0 < 2.12.2026

Gardyn Home Firmware 0

Gardyn Studio Firmware 0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-13768
Created by MichaelAdamGroberman

References

https://mygardyn.com/security/
https://www.cisa.gov/news-events/ics-advisories/icsa-26-1...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
9.5
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michael Groberman reported this vulnerability to CISA.
.