CVE-2025-1242

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub exposing connected devices to malicious control.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
Gardyn	Home Kit	< master.619
Gardyn	Home Kit Mobile Application	< 2.11.0
Gardyn	Home Kit Cloud API	< 2.12.2026

References

Timeline

Published: Feb 25, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-124209.8A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and CVE-2025-124219.9Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during CVE-2025-124229.8Vulnerable Upgrade Feature (Arbitrary File Write) may lead to obtaining super user permissions on board.This issue affects BLU-IC2: through CVE-2025-124237.5Protocol manipulation might lead to denial of service.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .CVE-2025-124249.8Privilege Escalation through SUID-bit Binary.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .CVE-2025-124257.8Local Privilege Escalation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .CVE-2025-124267.5The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.7.0.80. This is CVE-2025-124275.3The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4 CVE-2025-124288.8Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML pa CVE-2025-124298.8Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a c CVE-2025-12432.0The Temporal api-go library prior to version 1.44.1 did not send `update response` information to Data Converter when the proxy package with CVE-2025-124307.5Object lifecycle issue in Media in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML