Loading vulnerability…
CVE-2026-13768 is an exposure of a privileged Azure IoT Hub "iothubowner" credential in Gardyn devices. Possession of this highly privileged key allows unauthorized use of IoTHub Registry Manager functionality to enumerate Gardyn Home Kit and Studio devices and retrieve their connection information. The same credential can also be used to issue arbitrary commands to a targeted connected device, resulting in remote code execution on that device. Because the affected devices operate within users' local environments, successful exploitation may also enable follow-on access or pivoting to other systems on the same network.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a small standalone exploit suite for an alleged Gardyn/Azure IoT Hub key-exposure issue. It contains three Python programs and two Markdown documents. The main offensive component is poc.py, which uses the Azure IoT Hub SDK and an owner-level connection string to authenticate to Azure IoT Hub, enumerate devices, and invoke a cloud-to-device direct method named 'upgrade' to achieve arbitrary command execution on a selected device. The README states this RCE relies on command injection in that method and ties it to CVE-2025-29631. The exploit also includes helper logic for lightweight string obfuscation, local runtime-context/state writing under /tmp, optional C2 reachability checks, and post-exploitation workflows such as lateral movement and persistence command generation/execution. validate.py is a separate read-only validator. It accepts an IoT Hub owner connection string, creates an IoTHubRegistryManager, runs a device query ('SELECT deviceId FROM devices'), and exits successfully if at least one device is accessible. This is a detection/validation utility, but the repository overall is clearly exploit-oriented because poc.py performs active command execution. c2s.py is a lightweight Flask-based demo C2 server. It exposes GET /task/<device_id> for polling tasks, POST /result for result submission, GET /beacon.sh to serve a shell beacon, GET /tasks/<device_id> for debugging visibility, and POST /add_task to enqueue tasks. The embedded beacon script repeatedly polls the C2 over HTTP, executes returned shell commands with eval, and POSTs results back as JSON. Example initial tasks include uname, directory listing, process listing, and netstat/ss collection. TEMPLATES.md is not executable code but materially extends the exploit's capability by providing ready-made shell commands for LAN discovery, port scanning, and persistence across cron, systemd, init.d, rc.local, cron.d, and shell profile mechanisms. These templates reference an attacker-controlled beacon URL and common internal network ranges/ports. README.md documents installation, usage, and intended workflow. Overall purpose: weaponize a leaked Azure IoT Hub owner key into fleet-wide administrative access and device compromise. Main capabilities are passive validation, fleet enumeration, remote shell command execution via direct-method injection, optional beacon deployment, and post-exploitation actions from compromised IoT devices. The repository is not part of a larger exploit framework; it is a standalone operational PoC with a basic but functional payload and support infrastructure.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.