High

Hardcoded storage credentials in Gardyn mobile app and device firmware

IdentifiersCVE-2025-10681CWE-798· Use of Hard-coded Credentials

CVE-2025-10681 is a hard-coded credentials vulnerability affecting the Gardyn mobile application and device firmware. Storage credentials are embedded in the mobile app and firmware, and those credentials both fail to adequately restrict end-user permissions and do not expire within a reasonable period. As described in the available advisory content, use of these embedded credentials can permit unauthorized access to production storage containers. The issue is mapped to CWE-798 and is described as remotely exploitable over the network without privileges or user interaction.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation may allow an unauthenticated remote attacker to access production storage containers using the embedded storage credentials. The available CVSS vectors indicate high confidentiality impact with lower integrity and availability impact, consistent with unauthorized access to sensitive cloud-stored data and possible limited modification or disruption of stored content.

Mitigation

If you can’t patch tonight, do this now.

Until patches and credential rotation are fully deployed, minimize network exposure of affected Gardyn systems, ensure control devices are not directly reachable from the public internet, place control system networks and remote devices behind firewalls, and use secure updated VPN-based remote access only when required. Additional mitigation should include monitoring for unauthorized access to storage containers, revoking and regenerating embedded credentials, and restricting storage access policies to least privilege where operationally possible.

Remediation

Patch, then assume compromise.

Upgrade to fixed Gardyn software versions identified by the vendor/CISA advisory. The provided content states affected software includes Gardyn Mobile Application versions before 2.11.0 and Gardyn Cloud API versions prior to 2.12.2026; the broader advisory also references affected Gardyn Home Firmware and Gardyn Studio Firmware. Remediation should include removing hard-coded storage credentials from the mobile app and firmware, rotating any exposed credentials, replacing them with uniquely provisioned secrets, reducing permissions to least privilege, and enforcing reasonable credential expiration.

PUBLIC EXPLOITS

Exploits

No valid public exploits. Mallory filtered out 2 candidates as fakes, detection scripts, or README-only repos.

VALID 0 / 2 TOTALView more in app

All candidate exploits were filtered out by Mallory's validation.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

cyber security newsNews

Apr 21, 2026

Critical Gardyn Smart Gardens Vulnerabilities Let Attackers Control Devices Remotely

One of multiple critical vulnerabilities affecting Gardyn Home Kit smart garden systems that could contribute to remote compromise of devices and related cloud infrastructure.

cvefeed high severityNews

Apr 3, 2026

CVE-2025-10681 - Gardyn Mobile Application and Device Firmware Use Hard-coded Credentials

A hardcoded credentials vulnerability in a mobile app and device firmware that may allow unauthorized access to production storage containers.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3