CVE-2025-29631 Gardyn CVE debrief

Who should care

Owners and operators of Gardyn Home Kit and Studio devices, users who rely on the Gardyn mobile application, and anyone responsible for updating or monitoring these devices in connected-home or small-environment deployments should treat this as urgent. Security teams should also review the Gardyn Cloud API exposure described in the advisory.

Technical summary

CISA’s advisory describes a command-injection weakness consistent with CWE-78: OS Command Injection. The vulnerable code path does not sanitize input before passing content to the operating system for execution, creating a path for arbitrary OS command execution on the target device. The advisory’s affected-product listing includes Gardyn Home Firmware <master.619, Gardyn Studio Firmware, Gardyn Mobile Application <2.11.0, and Gardyn Cloud API <2.12.2026. The advisory carries a CVSS v3.1 score of 9.1/Critical with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Defensive priority

Immediate. The issue is network-exploitable, requires no privileges, and is scored Critical, so affected systems should be updated as soon as practical.

Recommended defensive actions

• Update the Gardyn mobile application to the latest supported version.
• Upgrade Gardyn Home firmware and Gardyn Studio firmware to master.622 or later, per the vendor guidance in the advisory.
• Confirm the current App and Home firmware versions inside the Gardyn app before and after remediation.
• Ensure affected devices have network connectivity so they can automatically download and apply required firmware updates.
• If updates do not complete, follow the vendor security page at https://mygardyn.com/security/ and contact [email protected] for assistance.
• Reassess any exposed automation or integration points that interact with the affected Gardyn services after patching.

Evidence notes

Primary facts come from the CISA CSAF advisory (ICSA-26-055-03) and the associated CVE record. The advisory was published on 2026-02-24 and revised on 2026-04-02 (Update A). The source description states that unsanitized input is passed to the operating system for execution, enabling arbitrary OS commands. The supplied advisory metadata also includes SSVCv2/E:P/A:Y/2026-03-31T05:00:00.000000Z and a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. No KEV entry was provided in the supplied enrichment data.

Official resources