CERT/CC VU#653116 | CISA Advisory ICSA-26-055-03 | All CVEs | Case Repository

• ID: Gr0m-003
• CVSS 3.1: 9.1 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
• CWE: CWE-798 (Use of Hard-coded Credentials)
• Status: Key reused after hub migration

The Azure IoT Hub administrative credential (iothubowner) was exposed for 5+ years via multiple vectors. The vendor migrated to a new hub but reused the same key, leaving devices using the shared credentials vulnerable.

May 2019 - Present (5+ years)

HostName=[REDACTED].azure-devices.net
SharedAccessKeyName=iothubowner
SharedAccessKey=[REDACTED]

The vendor migrated from an earlier IoT Hub to the current hub but reused the same shared access key. Anyone who captured the credential during the 5-year exposure window retains access.

The vendor stated to CISA that no access logging existed on the affected endpoints during the exposure window. The vendor's public security page is at https://mygardyn.com/security/.

Endpoint details removed — Specific API paths and field names have been removed from this public disclosure to reduce attacker enablement.

1. Unauthenticated device provisioning endpoint returned administrative credential (now removed)
2. Authenticated device claim endpoint returns administrative credential
3. Mobile app Hermes bytecode
4. Device firmware
5. Unauthenticated user enumeration endpoint returned administrative credential in every user record (CVE-2026-28766)

This single credential is the root enabler for multiple critical findings including remote code execution, fleet-wide device control, lateral movement to home networks, and mass credential extraction.

Attack chain mapping removed — Specific finding-to-capability mappings have been removed from this public disclosure to reduce attacker enablement.

Without this key, none of the critical attack chains work.

Anyone with this key has full administrative access to:

• 138,160+ registered devices
• All device twins and configurations
• Direct method invocation (RCE)
• Cloud-to-device messaging

1. Rotate the iothubowner key immediately
2. Generate new per-device credentials
3. Push OTA update with new credentials
4. Audit logs for unauthorized access
5. Implement key rotation schedule
6. Set up monitoring and alerting

Researcher: Michael Groberman — Gr0m Contact: [email protected] · LinkedIn