CVEvulnerability

CVE-2025-29629

9.1 CRITICAL Published 2025-07-25 Modified 2026-06-17 Official page ↗

Status: Deferred
Published: 2025-07-25
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses: CWE-1392, CWE-200, CWE-94

Description

Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for secure shell access. This may result in attackers gaining access to exposed Gardyn Home Kits.

Weakness · CWE (3)

CWE-1392 Use of Default Credentials weakness
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
CWE-94 Improper Control of Generation of Code weakness

References

https://github.com/mselbrede/gardyn/blob/main/CVE-2025-29629.md github.com
https://mygardyn.com/blog/security-update/ mygardyn.com
https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03 www.cisa.gov

CVE-2025-29629

Description

Related

Weakness · CWE (3)

References