CVE-2026-13768: Gardyn IoT Hub Use of Hard-coded Credentials

Synopsis

This is a hard-coded credentials vulnerability in the Gardyn IoT Hub firmware and cloud API. The privileged iothubowner key is embedded directly in the device and is reachable over the network by any unauthenticated attacker. Successful exploitation gives an attacker full read and write access to IoT Hub registry data for all connected Gardyn devices, the ability to run arbitrary commands on individual devices, and a foothold to pivot into the user's local network. Patched-image rebuilds at versions 2.12.2026 and master.627 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device or cloud API endpoint over the network; the hard-coded key is exposed to any host that can make a network connection to the service.

• AuthenticationNot required

  No credentials are needed because the iothubowner key is hard-coded in the device itself, removing authentication as a barrier entirely.

• Victim interactionNot required

  The attacker does not need any action from a user or device owner; exploitation is fully remote and passive.

• Attack complexityDetail

  Base exploit conditions are straightforward and condition-free, though the CVSS v4.0 vector notes an attack requirement of AT:P, meaning some specific deployment configuration or timing condition may need to be satisfied.

Blast Radius

• Reads connection information for every Gardyn Home Kit and Studio device registered in the IoT Hub, exposing device identifiers, endpoints, and credentials for the entire fleet.
• Executes arbitrary commands on any individually targeted connected Gardyn device.
• Provides a network pivot point into the local network of any affected user, allowing lateral movement to other hosts on the same segment.
• Modifies IoT Hub registry data and device state across the connected fleet, affecting device behavior and integrity at scale.