| Field | Value |
|---|---|
| CVE | CVE-2026-55726 |
| ICSA | ICSA-26-183-03 (Gardyn IoT Hub) |
| CVSS 3.1 | 5.3 (Medium) |
| Vector (3.1) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| Vector (4.0) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| CWE | CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) |
| Researcher | Michael Groberman |
| Published | 2026-07-02 |
| Coordinated finding | Gr0m-017 (public blob container device-log) |
| Field | Value |
|---|---|
| Vendor | Gardyn |
| Product | Gardyn Home Kit, Gardyn Studio |
| Component | Cloud API / Azure Blob Storage (device-log container) |
| Affected Versions | Home Firmware < master.627, Studio Firmware < master.627, Cloud API < 2.12.2026 |
The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user can enumerate and read any device log file in the container. Logs were available from approximately May 2020 through disclosure (5+ years).
The device-log container permits anonymous listing and object read. Exposed content includes:
| Data | Example / note |
|---|---|
| Device ID hashes | present in filenames |
| WiFi SSID names | including internal SSIDs such as Gardyn-Office |
| Internal script paths | filesystem layout of device software |
| System configurations | device settings |
| Firmware versions | fingerprinting / targeting |
| Boot sequences | startup behavior |
| Cron configurations | scheduled task detail |
| Error logs | stack traces |
Impact is information disclosure, device fingerprinting, and internal-network reconnaissance (SSID names and paths support targeting).
| Aspect | Detail |
|---|---|
| Gr0m-017 | Public blob container device-log, unauthenticated listing, logs from May 2020+ |
| CWE reconciliation | Researcher tracking classified CWE-200; CISA assigned the more specific CWE-497 |
| Distinct from | CVE-2025-10681 / Gr0m-004 (hardcoded blob credential) and Gr0m-011 (write-capable SAS token). This finding is the unauthenticated listing/read of the log container itself |
Per ICSA-26-183-03, Gardyn states the IoT Hub deployed infrastructure has been updated to address the listed vulnerabilities.
- Set the container access level to Private.
- Require SAS tokens (scoped, short-lived) for any required access.
- Audit existing objects; redact sensitive data (SSIDs, paths, credentials) from logs.
Researcher: Michael Groberman (Gr0m) · Case: CERT/CC VU#653116 · Advisory: ICSA-26-183-03