CVE-2025-29631

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-29631
Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through vulnerable methods that do not sanitize input before passing content to the operating system for execution. The vulnerability may allow an attacker to execute arbitrary operating system commands on a target Home Kit.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/mselbrede/gardyn/blob/main/CVE-2025-29628_CVE-2025-29631.md
https://mygardyn.com/blog/security-update/
https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03
Configurations

No configuration.

History

25 Feb 2026, 21:16

Type Values Removed Values Added
CWE CWE-78
References
  • {'url': 'http://gardyn.com', 'source': 'cve@mitre.org'}
Summary (en) Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 is vulnerable to command injection through vulnerable methods that do not sanitize input before passing content to the operating system for execution. The vulnerability may allow an attacker to execute arbitrary operating system commands on a target Home Kit. (en) Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through vulnerable methods that do not sanitize input before passing content to the operating system for execution. The vulnerability may allow an attacker to execute arbitrary operating system commands on a target Home Kit.

25 Feb 2026, 17:25

Type Values Removed Values Added
Summary (en) An issue in Gardyn 4 allows a remote attacker execute arbitrary code (en) Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 is vulnerable to command injection through vulnerable methods that do not sanitize input before passing content to the operating system for execution. The vulnerability may allow an attacker to execute arbitrary operating system commands on a target Home Kit.
References
  • () https://mygardyn.com/blog/security-update/ -
  • () https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03 -

29 Jul 2025, 14:14

Type Values Removed Values Added
Summary
  • (es) Un problema en Gardyn 4 permite que un atacante remoto ejecute código arbitrario

25 Jul 2025, 19:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CWE CWE-94

25 Jul 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-25 17:15

Updated : 2026-04-15 00:35

NVD link : CVE-2025-29631

Mitre link : CVE-2025-29631

CVE.ORG link : CVE-2025-29631

JSON object : View

Products Affected

No product.

CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-94

Improper Control of Generation of Code ('Code Injection')