Is CVE-2025-10681 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-10681 being exploited in the wild.

How severe is CVE-2025-10681?

High severity, with a CVSS score of 8.6, published 3 April 2026.

Which products and versions are affected?

Gardyn Cloud API < 2.12.2026; Gardyn Home Firmware < 627; Gardyn Studio Firmware < 627.

Is there a fix for CVE-2025-10681?

A patch was published on 2026-02-24: Original remediation and internal publication by Gardyn Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-10681 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-10681?

Check whether you run Gardyn Cloud API, Gardyn Home Firmware or Gardyn Studio Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-10681: Gardyn Home Kit hardcoded storage credentials in mobile app and firmware

Q: Which products and versions are affected?

Gardyn Cloud API < 2.12.2026; Gardyn Home Firmware < 627; Gardyn Studio Firmware < 627.

Q: Is there a fix for CVE-2025-10681?

A patch was published on 2026-02-24: Original remediation and internal publication by Gardyn Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-10681 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2025-10681?

Check whether you run Gardyn Cloud API, Gardyn Home Firmware or Gardyn Studio Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-10681 · Severity: high · CVSS 8.6 · Published 2026-04-03

Gardyn smart indoor gardening systems are affected by a security flaw where storage credentials were permanently embedded in the mobile app and device software. An attacker could use these credentials to gain unauthorized access to the company's cloud storage, potentially exposing customer data such as plant photos and limited contact information. The manufacturer has released updates that fix this issue and rotate the compromised credentials.

Technologies: Gardyn Cloud API, Gardyn Home Firmware, Gardyn Studio Firmware. Vendors: Gardyn.

Quick answers

Is CVE-2025-10681 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-10681 being exploited in the wild.
How severe is CVE-2025-10681?: High severity, with a CVSS score of 8.6, published 3 April 2026.
Which products and versions are affected?: Gardyn Cloud API < 2.12.2026; Gardyn Home Firmware < 627; Gardyn Studio Firmware < 627.
Is there a fix for CVE-2025-10681?: A patch was published on 2026-02-24: Original remediation and internal publication by Gardyn Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-10681 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-10681?: Check whether you run Gardyn Cloud API, Gardyn Home Firmware or Gardyn Studio Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability (CWE-798) involves the use of hardcoded credentials within the Gardyn mobile application and device firmware. These credentials facilitate access to production storage containers (such as Azure IoT Hub or similar cloud storage) but lack adequate permission limiting and do not expire. A remote, unauthenticated attacker can extract these credentials from the application or firmware to gain unauthorized access to cloud-based storage. This could lead to the exposure of user information, including plant photos and demographic data (name, address, phone number). Gardyn has remediated the issue by updating the Mobile App to version 2.11.0, the Cloud API to 2.12.2026, and device firmware to version 627 or later.

Affected products

Gardyn Mobile Application < 2.11.0
Gardyn Cloud API < 2.12.2026
Gardyn Home Firmware < 627
Gardyn Studio Firmware < 627

Timeline

2026-02-24: patched: Original remediation and internal publication by Gardyn
2026-04-02: other: Revision of Gardyn security update
2026-04-03: advisory: Initial NVD/CISA publication
2026-07-02: other: Final revision of CISA advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.