VulnerabilityDeferred

CVE-2025-29629

Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for secure shell access.

CRITICAL 9.1EPSS 0.47%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.47%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for secure shell access. This may result in attackers gaining access to exposed Gardyn Home Kits.

CVSS 3.1: 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: 0.47% probability · 39th percentile
CISA KEV: Not listed
Weakness: CWE-1392, CWE-94, CWE-200
Source: cve@mitre.org

References

https://github.com/mselbrede/gardyn/blob/main/CVE-2025-29629.md
https://mygardyn.com/blog/security-update/
https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.