CVE-2026-13768: Privileged IoT Hub Credential — Fleet Enumeration, Device RCE, and Home-Network Pivot

Advisory

Field	Value
CVE	CVE-2026-13768
ICSA	ICSA-26-183-03 (Gardyn IoT Hub)
CVSS 3.1	10.0 (Critical)
Vector (3.1)	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Vector (4.0)	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
CWE	CWE-798 (Use of Hard-coded Credentials)
Researcher	Michael Groberman
Published	2026-07-02
Coordinated finding	Gr0m-012 (IoT Hub fleet control) + Gr0m-013 (lateral network access)

Product

Field	Value
Vendor	Gardyn
Product	Gardyn Home Kit, Gardyn Studio
Component	Azure IoT Hub control plane, Cloud API, device firmware
Affected Versions	Home Firmware < master.627, Studio Firmware < master.627, Cloud API < 2.12.2026

Summary

Gardyn exposes a privileged iothubowner shared-access key. Access to this key allows a malicious user to invoke an Azure IoT Hub Registry Manager function that returns connection information for all Gardyn Home Kit and Studio devices. The same key allows execution of arbitrary commands on a specific connected device and can allow the attacker to pivot to other devices on the victim's home network.

This is the IoT Hub advisory (ICSA-26-183-03) cataloging the control-plane blast radius of the administrative credential. It is related to, but distinct from, CVE-2025-1242 in ICSA-26-055-03, which cataloged the exposure of the iothubowner credential through unauthenticated API responses, mobile-app reverse engineering, and firmware analysis. CVE-2026-13768 captures what possession of that credential enables: fleet-wide enumeration, per-device remote code execution, and lateral movement into the home LAN.

Vulnerability Details

The credential

The iothubowner shared-access policy is the highest-privilege credential in Azure IoT Hub. Microsoft documents it as backend-service-administration only, never to be distributed to clients.

Permission	Capability
RegistryRead	Enumerate every device in the fleet
RegistryWrite	Create / delete / modify device registrations
ServiceConnect	Send cloud-to-device messages
DeviceConnect	Send device-to-cloud messages (impersonate any device)
ServiceInvoke	Invoke direct methods on any device

Fleet enumeration (Registry Manager)

With the key, IoTHubRegistryManager returns connection information for the entire fleet:

from azure.iot.hub import IoTHubRegistryManager
manager = IoTHubRegistryManager.from_connection_string(hub_conn_string)  # iothubowner
online = manager.query_iot_hub("SELECT * FROM devices WHERE connectionState = 'Connected'")

Metric	Count	Source
Registered devices	138,160+	CISA / advisory record
Devices enumerated	129,949	Researcher enumeration, Dec 2025
Online at enumeration	38,831	Researcher enumeration, Dec 2025

Per-device remote code execution

Cloud-to-device direct methods reach any device. Combined with the command-injection path in the device upgrade() handler (CVE-2025-29631), a C2D method yields root command execution on the target device:

from azure.iot.hub.models import CloudToDeviceMethod
method = CloudToDeviceMethod(method_name="upgrade", payload={
    "uri": "http://x; <command> ",   # injection sink in upgrade()
    "path": "/tmp/x", "services": []})
manager.invoke_device_method(device_id, method)

Home-network pivot

Each device sits on the customer's home WiFi. Command execution on the device provides a foothold behind the home firewall, from which an attacker can scan the LAN and interact with other hosts (routers, NAS, cameras, smart locks, personal computers). The device is the pivot point; it is already inside the network. This is the Gr0m-013 lateral-movement condition.

Mapping to coordinated findings

Aspect	Detail
Gr0m-012	IoT Hub fleet control — enumeration, twin read/write, direct-method invocation, mass RCE potential
Gr0m-013	Lateral network access — device-as-pivot into 38,831+ home networks
Consolidation	CISA published both conditions under one CWE-798 CVE (both were classified CWE-798 in the VU#653116 tracking sheet)
Relationship to CVE-2025-1242	1242 (ICSA-26-055-03) = credential exposure; 13768 (ICSA-26-183-03) = credential blast radius (control plane + lateral). Distinct remediation surfaces
Scope	CISA applied Scope:Changed (S:C), yielding base 10.0

Remediation

Per ICSA-26-183-03, Gardyn states the IoT Hub deployed infrastructure has been updated to address the listed vulnerabilities.

1. Rotate the iothubowner administrative credential (breaks initial access).
2. Issue least-privilege, per-device credentials; retire fleet-wide administrative keys from any client-reachable path.
3. Eliminate the upgrade() command-injection sink (CVE-2025-29631) to remove the RCE primitive.
4. Enforce command allowlisting for direct methods.
5. Enable IoT Hub access logging and anomaly alerting (the vendor stated to CISA that no access logging existed on the affected endpoints during the exposure window).

---

Researcher: Michael Groberman (Gr0m) · Case: CERT/CC VU#653116 · Advisory: ICSA-26-183-03