CVE-2026-54477: Gardyn IoT Hub missing security headers in admin panel

CVE-2026-54477 · Severity: medium · CVSS 5.4 · Published 2026-07-03

The admin panel for Gardyn smart gardening systems lacks standard security headers, which are basic protections used by web browsers to prevent malicious interference. This omission makes the system vulnerable to clickjacking and cross-site scripting, where an attacker could trick a user into performing unintended actions or steal sensitive session information. While there is no evidence of active exploitation, these flaws could compromise the privacy of plant data or user account details if a user visits a malicious website while logged into their Gardyn account.

Technologies: Gardyn Cloud API, Gardyn Home Firmware, Gardyn Studio Firmware. Vendors: Gardyn.

Quick answers

Is CVE-2026-54477 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54477 being exploited in the wild.
How severe is CVE-2026-54477?
Medium severity, with a CVSS score of 5.4, published 3 July 2026.
Which products and versions are affected?
Gardyn Cloud API < 2.12.2026; Gardyn Home Firmware < master.627; Gardyn Studio Firmware < master.627.
Is there a fix for CVE-2026-54477?
A patch was published on 2026-02-24: Initial security update published by Gardyn Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54477 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54477?
Check whether you run Gardyn Cloud API, Gardyn Home Firmware or Gardyn Studio Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as an improper neutralization of HTTP headers (CWE-644) within the Gardyn admin panel. The absence of standard security headers (such as Content-Security-Policy or X-Frame-Options) allows for clickjacking and cross-site scripting (XSS) attacks. An unauthenticated remote attacker can exploit this by inducing a legitimate user to interact with a malicious link or framed page, potentially leading to unauthorized actions or information disclosure. Gardyn has remediated the issue by updating the Cloud API and deploying firmware updates (master.627 or later) which are automatically applied when devices are connected to the internet.

Affected products

  • Gardyn Gardyn Home Firmware < master.627
  • Gardyn Gardyn Studio Firmware < master.627
  • Gardyn Gardyn Cloud API < 2.12.2026

Timeline

  • 2026-02-24: patched: Initial security update published by Gardyn
  • 2026-07-02: advisory: CISA ICSA-26-183-03 published
  • 2026-07-03: disclosed: CVE-2026-54477 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.