CVE-2025-10681: Hardcoded Azure Blob Storage Account Key

Advisory

Product

Summary

An Azure Blob Storage account key is hardcoded in both the Gardyn device firmware and mobile application. This account-level credential grants access to all blob containers including OTA firmware updates, device logs, and camera images from approximately 115,000 devices.

Vulnerability Details

Exposed Storage Accounts

Account names removed — Specific Azure resource identifiers have been removed from this public disclosure to reduce attacker enablement.

Three Azure Blob Storage accounts are accessible via the hardcoded key. They serve camera still images, device logs, OTA updates, timelapse videos (constructed from still images), and thumbnail images — all at account-level (full access) permissions. The Gardyn camera does not capture or store audio streams; all camera-related media is image-based.

Credential Location

The storage account key is embedded in:

1. Device firmware — plaintext in configuration files under /usr/local/etc/gardyn/
2. Mobile application — React Native Hermes bytecode in index.android.bundle

Accessible Containers

Container names removed — Specific resource identifiers have been removed from this public disclosure to reduce attacker enablement.

Enumeration revealed containers containing home interior camera images (~115,000 cameras), device diagnostic logs (5+ years), timelapse recordings, and firmware update packages. Camera image, log, and OTA update containers have read/write access.

Write access to the OTA firmware container provides architectural access to the firmware update pipeline.

Impact

• Read access to home interior camera images from approximately 115,000 Gardyn cameras
• Read/write access to OTA firmware update storage — enables supply chain attacks
• Access to 5+ years of device diagnostic logs
• Storage cost attacks via arbitrary blob uploads
• Architectural access to the OTA firmware update pipeline

Azure Services Available for This Class of Endpoint

The account key provides unrestricted access to all containers, including ~115,000 home interior camera images, 5+ years of diagnostic logs, and the OTA firmware update pipeline.

Remediation

Recommended mitigations for device owners:

• Isolate the Gardyn device on a dedicated VLAN or IoT network segment
• Monitor for unexpected outbound connections from the device

Recommended fix for the vendor:

1. Rotate all Azure Storage account keys immediately
2. Remove hardcoded credentials from firmware and mobile application
3. Implement per-device scoped SAS tokens with minimal permissions
4. Set all containers to private access level
5. Implement code signing for OTA firmware packages
6. Add integrity verification for downloaded firmware

Timeline

References

• CVE-2025-10681 — CVE Record
• ICSA-26-055-03
• CWE-798: Use of Hard-coded Credentials

Credit

Reported by Michael Groberman — Gr0m to CISA.