Back to Database
Status published
Critical
CVE-2025-29631
Gardyn Home Kit firmware before master.619, Home Kit Mobile Application...
Vulnerability Description
Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through vulnerable methods that do not sanitize input before passing content to the operating system for execution. The vulnerability may allow an attacker to execute arbitrary operating system commands on a target Home Kit.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-29631
Credits & Attribution
No credits recorded in the NVD database.
References
More from Gardyn
View All →CVE-2025-29629
Gardyn Home Kit firmware before master.619, Home Kit Mobile Application...
Critical
9.1
CVE-2025-29628
A Gardyn Azure IoT Hub connection string is downloaded over...
Critical
9.4
CVE-2025-1242
Administrative Credentials Can Be Extracted Through Gardyn API Responses
Critical
9.3
CVE-2025-10681
Gardyn Mobile Application and Device Firmware Use Hard-coded Credentials
High
8.8
Affected Vendor
Gardyn
View all reports →Affected Software
Home Kit Firmware
Vulnerable Versions:
0
Timeline
Official Publish:
July 25th, 2025
Last Modified:
February 25th, 2026
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H