CVE-2025-29629 Hardcoded credentials in Home Kit Firmware
Attackers can gain unauthorized access to exposed Gardyn Home Kits using weak default SSH credentials, potentially leading to full device compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-29629?
CVE-2025-29629 is a critical vulnerability in Gardyn Home Kit Firmware, published on 25 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for secure shell access. This may result in attackers gaining access to exposed Gardyn Home Kits.
Which versions are affected by CVE-2025-29629?
How do I fix CVE-2025-29629?
No fix has been published for CVE-2025-29629 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-29629 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-29629 exists.
Sources
Also known as GHSA-7422-rhq7-3wfj.