Clickjacking and XSS Vulnerability in Gardyn Admin Panel
CVE-2026-54477

5.1MEDIUM

Key Information:

Vendor

Gardyn

Status
Gardyn Home Firmware
Gardyn Studio Firmware
Gardyn Cloud Api
Vendor
CVE Published:
2 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-54477?

The Gardyn Admin Panel has a significant vulnerability due to the absence of standard security headers, making it susceptible to clickjacking and cross-site scripting (XSS) attacks. These weaknesses can allow malicious actors to manipulate user interactions and potentially access sensitive information, compromising the security of the application and its users.

Affected Version(s)

Gardyn Cloud API 0 < 2.12.2026

Gardyn Home Firmware 0

Gardyn Studio Firmware 0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-54477
Created by MichaelAdamGroberman

References

https://mygardyn.com/security/
https://www.cisa.gov/news-events/ics-advisories/icsa-26-1...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michael Groberman reported this vulnerability to CISA.
.