CVE-2025-29631 Command injection in Home Kit Firmware
Attackers can execute arbitrary OS commands on Gardyn Home Kit devices via unsanitized input in firmware, mobile app, or cloud API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-29631?
CVE-2025-29631 is a critical command injection vulnerability in Gardyn Home Kit Firmware, published on 25 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through vulnerable methods that do not sanitize input before passing content to the operating system for execution. The vulnerability may allow an attacker to execute arbitrary operating system commands on a target Home Kit.
Which versions are affected by CVE-2025-29631?
How do I fix CVE-2025-29631?
No fix has been published for CVE-2025-29631 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-29631 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-29631 exists.
Sources
Also known as GHSA-4993-4c8h-h8w5.