CVE-2026-54477mediumCWE-644

Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 0.3%

from disclosure to weapon0 days

Published on NVDJul 2

1st PoCJul 2

exploitation probability

0.3%top 81% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Affected products

public PoCs found — 1

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References