CVE-2025-1242

9.3 criticalEPSS 0.6%

Critical (9.3). EPSS 0.6% chance of exploitation in the next 30 days.

The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub exposing connected devices to malicious control.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE: CWE-798
Published: 2026-02-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-055-03.json
https://mygardyn.com/security/
https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03

Check your stack JSON