CVE-2025-29631 CRITICAL

CVE-2025-29631

Vendor Gardyn

Product Home Kit Firmware

Weakness CWE-78

Published July 25, 2025

Last update February 25, 2026

View on NVD All CVEs

CVSS base score

9.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through vulnerable methods that do not sanitize input before passing content to the operating system for execution. The vulnerability may allow an attacker to execute arbitrary operating system commands on a target Home Kit.

Key dates

02Disclosure timeline

July 25, 2025 CVE published

February 25, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-29631 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/78.html

Related vulnerabilities

04Related CVE

CVE-2023-3097 KylinSoft kylin-software-properties setMainSource os command injection CVE-2024-5297 D-Link D-View executeWmicCmd Command Injection Remote Code Execution Vulnerability CVE-2026-27965 Vitess users with backup storage access can gain unauthorized access to production deployment environments CVE-2025-58062 LSTM-Kirigaya's openmcp-client Vulnerable to RCE in MCP Authorization Flow CVE-2026-25130 Cybersecurity AI vulnerable to command Injection through argument injection in find_file Agent tool