Cybersecurity researchers and CISA have disclosed four critical vulnerabilities in Gardyn Home and Gardyn Studio smart gardening systems. These flaws allowed unauthenticated attackers to remotely hijack devices, execute arbitrary commands, and access sensitive user information.

Key Vulnerabilities Identified

The flaws, discovered by researcher Michael Groberman, included hardcoded administrative credentials (CVE-2025-1242) and OS command injection (CVE-2025-29631). Other issues involved the insecure transmission of Azure IoT Hubcredentials and weak default SSH configurations.

Potential Impact

These security gaps enabled unauthorized attackers to take full control of device hardware—such as altering watering and lighting schedules—access user photos and personal information, and potentially move laterally within the Gardyn network.