CISA Bulletin: Gardyn IoT Hub Multiple Vulnerabilities (Hardcoded Creds, Info Disclosure)

Vulnerability Overview Vulnerability Name: Gardyn IoT Hub Published Date: July 2, 2026 Alert Code: ICSA-26-183-03 Related Topics: Industrial Control Systems Vulnerabilities, Industrial Control Systems Scope of Impact Affected Versions: - Home Firmware - Studio Firmware - Cloud API <2.12.2026 (CVE-2026-13768, CVE-2026-55726, CVE-2026-54477) CVSS Score: v3 10 Vendor: Gardyn Device: Gardyn IoT Hub Vulnerability Details: - Use of hardcoded credentials - Exposure of sensitive system information to unauthorized control spaces - Neutralization of script syntax within HTTP headers Remediation Recommended Practices: - Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. - Place control system networks and remote devices behind firewalls and isolate them from business networks. - When remote access is required, use more secure remote methods such as Virtual Private Networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the latest version. - Organizations should conduct appropriate impact analysis and risk assessment before deploying defensive measures. - Implement recommended cybersecurity policies to proactively defend ICS assets. Additional Mitigation Guidance: - Additional mitigation guidance and recommended practices are publicly available on the ICS website, including the technical information document ICS-TIP-12-146-01B — Targeted Intrusion Detection and Mitigation Strategies. - Organizations should follow internal procedures to report findings of malicious activities to CISA for tracking and correlation. Other Information Context: - Critical Infrastructure Sector: Food and Agriculture - Deployed Countries/Regions: United States - Corporate Headquarters Location: United States Acknowledgements: - Michael Groberman reported these vulnerabilities to CISA. Legal Notice and Terms of Use: - This product is subject to this notice and the privacy and usage policy. Revision History: - Initial Publication Date: July 2, 2026 Tags Sector: Food and Agriculture Sector Topics: Industrial Control Systems Vulnerabilities, Industrial Control Systems Related Advisories CubeSpace CW0057 Reaction Wheel ST Engineering iDirect iQ-Series Terminals Mitsubishi Electric MELSOFT Update Manager SW10ND-UDM-M Schneider Electric EasyLogic T150 and Saitel DP RTU Feedback Please share your thoughts: We recently updated our anonymous product survey and welcome your feedback. Footer CISA Central 1-844-Say-CISA contact@cisa.dhs.gov Related Links About CISA Budget and Performance DHS.gov FOIA Requests No FEAR Act Office of Inspector General Privacy Policy Subscribe The White House USA.gov Website Feedback Summary This page primarily outlines several security vulnerabilities in the Gardyn IoT Hub, including hardcoded credentials, sensitive information exposure, and HTTP header script syntax issues. Affected versions include Home Firmware, Studio Firmware, and Cloud API <2.12.2026. CISA provides detailed remediation advice and recommended practices to minimize the risks associated with these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

CISA Bulletin: Gardyn IoT Hub Multiple Vulnerabilities (Hardcoded Creds, Info Disclosure)