CVE-2025-29628 - CVE House
Back to Database
Status published Critical CVE-2025-29628

A Gardyn Azure IoT Hub connection string is downloaded over...

Vulnerability Description

A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 leaving the string vulnerable to interception and modification through a Man-in-the-Middle attack. This may result in the attacker capturing device credentials or taking control of vulnerable home kits.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-29628

Credits & Attribution

No credits recorded in the NVD database.

References

More from Gardyn

View All →
CVE-2025-29631
Gardyn Home Kit firmware before master.619, Home Kit Mobile Application...
Critical 9.8
CVE-2025-29629
Gardyn Home Kit firmware before master.619, Home Kit Mobile Application...
Critical 9.1
CVE-2025-1242
Administrative Credentials Can Be Extracted Through Gardyn API Responses
Critical 9.3
CVE-2025-10681
Gardyn Mobile Application and Device Firmware Use Hard-coded Credentials
High 8.8

Affected Vendor

Affected Software

Home Kit Firmware
Vulnerable Versions:
0

Timeline

Official Publish: July 25th, 2025
Last Modified: February 25th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Weaknesses (CWE)

CWE-924

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.