Gardyn IoT Hub

CISA released an ICS advisory for Gardyn IoT Hub identifying three vulnerabilities affecting Home Firmware, Studio Firmware, and Cloud API versions prior to 2.12.2026. The most critical vulnerability (CVE-2026-13768, CVSS 10) involves exposed hard-coded iothubowner credentials allowing unauthenticated remote code execution on connected devices and potential lateral movement. CVE-2026-55726 exposes Azure Blob Storage device logs publicly without authentication. CVE-2026-54477 affects the admin panel with missing security headers enabling clickjacking and XSS attacks. All vulnerabilities affect the Food and Agriculture critical infrastructure sector deployed in the United States. Gardyn has patched the infrastructure and recommends users ensure devices have internet connectivity for automatic firmware updates. No known public exploitation has been reported at the time of publication.