CVE-2025-29628CWE-924

A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home Kit Mobile…

Critical · published July 25, 2025

CVSS v3.1
9.4
EPSS
0%
Percentile
21.2
In the wild
Unconfirmed
What it is

A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 leaving the string vulnerable to interception and modification through a Man-in-the-Middle attack. This may result in the attacker capturing device credentials or taking control of vulnerable home kits.

The record
Technical detail
CVSS v3.1
9.4 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00297 · 21.2th percentile
Weakness
CWE-924 · Improper Enforcement of Message Integrity During Transmission in a Communication Channel
Published
2025-07-25T00:00Z
EPSS history
Timeline
  • 25 JUL 00:00Z
    A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home Kit Mobile…
    cvelistv5