CVE-2025-1242: Exposure of Administrative IoT Hub Credentials

Advisory

Product

Summary

The Azure IoT Hub administrative credential (iothubowner shared access policy) is extractable through multiple vectors including unauthenticated API responses, mobile application reverse engineering, and device firmware analysis. This credential grants administrative control over the Gardyn IoT Hub, which architecturally manages all registered devices.

Vulnerability Details

The Credential

The iothubowner shared access policy is the highest-privilege credential in Azure IoT Hub. It grants:

Microsoft documentation states: "The iothubowner policy has all permissions and should be used with extreme caution. It is intended for backend service administration only and should NEVER be distributed to clients."

A single iothubowner connection string provides administrative access to the Gardyn IoT Hub.

Exposure Vectors

The credential was exposed through multiple independent channels:

1. Unauthenticated API endpoint

An unauthenticated device provisioning endpoint returned the administrative credential to any caller. No authentication was required. The endpoint was accessible to anyone on the internet.

Request details removed — Specific endpoint paths, field names, and request structures have been removed from this public disclosure to reduce attacker enablement.

The administrative credential field was subsequently removed from this endpoint's response (partial fix), but the endpoint still returns device-level credentials without authentication.

2. Unauthenticated user enumeration endpoint

An unauthenticated user listing endpoint returned complete records for all 134,215 registered users. Every record included the administrative credential — 134,215 copies in a single API response.

Request details removed — Specific endpoint paths and field names have been removed from this public disclosure to reduce attacker enablement.

This endpoint also exposed sensitive PII for all users including full names, email addresses, phone numbers, partial payment card numbers, sequential user IDs (enabling IDOR), device IDs, and connection credentials.

Per CISA ICSA-26-055-03, this exposure path is remediated in the published fix versions.

3. Mobile application

The credential is embedded in the React Native application bundle (Hermes bytecode in index.android.bundle). It is also distributed via Firebase Remote Config, which logs credentials to Android logcat in debug builds.

4. Device firmware

The connection string is present in device firmware files under /usr/local/etc/gardyn/ and is logged to syslog in cleartext during initialization.

Exposure Window

The credential has been exposed since at least May 2019 (6+ years based on API endpoint availability). The vendor migrated from an earlier IoT Hub ([REDACTED — IoT Hub name]) to the current hub ([REDACTED — IoT Hub name]) but reused the same shared access key, meaning anyone who captured the credential during the original exposure window retains access.

The vendor confirmed that no access logging existed on the affected endpoints, meaning the scope of unauthorized access during the 6+ year exposure window cannot be determined.

The vendor stated to CISA that no access logging existed on the affected endpoints during the exposure window. The vendor's public security page is at https://mygardyn.com/security/.

Impact

An attacker with the iothubowner credential can:

• Enumerate registered devices via IoT Hub registry queries
• Invoke direct methods on registered devices, including the upgrade() method vulnerable to command injection (CVE-2025-29631)
• Read and modify device twin configurations
• Send cloud-to-device messages
• Create or delete device registrations
• Access device telemetry data

Combined with CVE-2025-29631, this credential enables remote code execution as root on devices using the shared credentials (verified on researcher's own device).

Why This Credential Matters

This credential, combined with the IoT Hub hostname, allowed direct administrative access to the IoT Hub managing the affected Gardyn device fleet. The capabilities of an iothubowner credential are documented by Microsoft (see Impact above and the linked Azure documentation in References). CISA rated this CVE at CVSS 9.1 (Critical).

The other CVEs in ICSA-26-055-03 are documented as independent findings; this credential's exposure is a distinct issue from those vulnerabilities, although a single attacker holding multiple findings could combine them in some scenarios.

Azure Services Available for This Class of Endpoint

Microsoft's own documentation explicitly states: "The iothubowner policy has all permissions and should be used with extreme caution. It is intended for backend service administration only and should NEVER be distributed to clients."

Remediation

Recommended mitigations for device owners:

• Isolate the Gardyn device on a dedicated VLAN or IoT network segment
• Monitor the device for unexpected network activity
• Do not place the device on networks containing sensitive systems

Recommended fix for the vendor:

1. Immediately rotate the iothubowner shared access key
2. Remove the administrative credential from all API responses, mobile application code, and Firebase Remote Config
3. Implement per-device scoped credentials using Azure IoT Hub Device Provisioning Service (DPS) with X.509 certificates
4. Require authentication on all API endpoints that return device or hub credentials
5. Audit IoT Hub access logs for unauthorized access during the exposure window
6. Implement monitoring and alerting for anomalous IoT Hub administrative operations

Timeline

References

• CVE-2025-1242 — CVE Record
• ICSA-26-055-03
• CSAF JSON
• CWE-798: Use of Hard-coded Credentials
• Azure IoT Hub Shared Access Policies

Credit

Reported by Michael Groberman — Gr0m to CISA.