CVE-2025-29631

CriticalRCE

Published: 25 July 2025

Published

25 July 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0058 69.0th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-29631 is a critical-severity OS Command Injection (CWE-78) vulnerability in Mygardyn (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly addresses the lack of input sanitization by requiring validation of all inputs before passing to the OS, preventing command injection in the firmware, app, and API.

SI-2 Flaw Remediation good match

prevent

Mandates timely remediation of known flaws like this CVE through patching to the specified firmware master.619+, app 2.11.0+, and API 2.12.2026+ versions.

SI-9 Information Input Restrictions partial match

prevent

Restricts input types, amounts, and characteristics to block malicious payloads from reaching vulnerable methods that execute OS commands.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

Why these techniques?

Command injection (CWE-78) in exposed firmware/API enables remote unauthenticated RCE via T1190; arbitrary OS command execution maps to Unix Shell (T1059.004) on embedded device.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through vulnerable methods that do not sanitize input before passing content to the operating system for execution. The…

vulnerability may allow an attacker to execute arbitrary operating system commands on a target Home Kit.

Deeper analysisAI

CVE-2025-29631 is a command injection vulnerability (CWE-78, CWE-94) present in Gardyn Home Kit firmware versions before master.619, Home Kit Mobile Application versions before 2.11.0, and Home Kit Cloud API versions before 2.12.2026. The affected components expose vulnerable methods that fail to sanitize user input before passing it to the operating system for execution, enabling arbitrary command execution on target Home Kit devices. Published on 2025-07-25, the vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical.

An unauthenticated remote attacker can exploit this vulnerability over the network with low attack complexity and without requiring user interaction. Exploitation allows the attacker to execute arbitrary operating system commands on the targeted Home Kit device, granting high-impact access to confidentiality, integrity, and availability.

Advisories provide mitigation details, including updates to patched versions: firmware master.619 or later, mobile application 2.11.0 or later, and cloud API 2.12.2026 or later. Refer to the Gardyn security update at https://mygardyn.com/blog/security-update/, the GitHub analysis at https://github.com/mselbrede/gardyn/blob/main/CVE-2025-29628_CVE-2025-29631.md, and CISA ICS Advisory ICSA-26-055-03 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03 for full remediation guidance.