Home Kit Firmware
Approved changes feed: RSS · Atom
cpe:2.3:a:gardyn:home_kit_firmware:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Gardyn (00fc7b21-940a-5c8b-ab87-23b1d44cfff2) |
|---|---|
| Product | Home Kit Firmware (1bb1c0ee-20a6-573a-99a7-516042df7895) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-29631 |
vulnerable | 2026-06-08 07:14:56.522302 |
Details available
CRITICAL (9.8)
Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through vulnerable methods that do not sanitize input before passing content to the operating system for execution. The vulnerability may allow an attacker to execute arbitrary operating system commands on a target Home Kit.
Published: 2025-07-25T00:00:00.000Z
Updated: 2026-02-25T20:51:43.547Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-29629 |
vulnerable | 2026-06-08 07:14:56.521939 |
Details available
CRITICAL (9.1)
Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for secure shell access. This may result in attackers gaining access to exposed Gardyn Home Kits.
Published: 2025-07-25T00:00:00.000Z
Updated: 2026-02-25T20:42:11.351Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-29628 |
vulnerable | 2026-06-08 07:14:56.521441 |
Details available
CRITICAL (9.4)
A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 leaving the string vulnerable to interception and modification through a Man-in-the-Middle attack. This may result in the attacker capturing device credentials or taking control of vulnerable home kits.
Published: 2025-07-25T00:00:00.000Z
Updated: 2026-02-25T20:14:40.989Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.