CVE-2026-32646 Details

A vulnerability exists in the Gardyn Home Kit and Gardyn Studio ecosystems, allowing unauthenticated users to access and control edge devices. This includes management functions through an administrative endpoint, as well as access to cloud-based devices and user information. The issue arises from specific administrative endpoints that are accessible without proper authentication, exposing device management functions. Successful exploitation could also allow pivoting to other edge devices managed in the Gardyn cloud environment.

Users are advised to update their Gardyn Home Kit and Studio devices to firmware version master.622 or later. For the Gardyn mobile application, users should update to version 2.11.0 or later. Further information on Gardyn security can be found on the Gardyn security webpage. Customer support is available through the Gardyn Help Center or via email.