Gardyn Cloud API Missing Authentication on User Account Endpoint

#!/usr/bin/env bash
# check_gardyn.sh — Detect Gardyn IoT devices on your enterprise network
# Usage: ./check_gardyn.sh <CIDR>
# Requires: nmap, arp (standard on Linux/macOS)
# Output: VULNERABLE (Gardyn devices found) / PATCHED (none found) / UNKNOWN (scan error)

set -euo pipefail

CIDR="${1:-}"

if [ -z "$CIDR" ]; then
  echo "Usage: $0 <CIDR> (e.g., 192.168.1.0/24)"
  echo "UNKNOWN"
  exit 2
fi

if ! command -v nmap &>/dev/null; then
  echo "ERROR: nmap is required but not installed."
  echo "UNKNOWN"
  exit 2
fi

echo "[*] Scanning $CIDR for Gardyn IoT devices..."
echo "[*] Looking for Gardyn-associated identifiers in host discovery..."

# Perform host discovery and service detection
SCAN_OUTPUT=$(nmap -sn -oG - "$CIDR" 2>/dev/null || true)

# Check ARP table for Gardyn-associated MAC prefixes
# Gardyn Home Kit uses Espressif (ESP32) chipsets
# Common Espressif OUI prefixes
ESP_OUIS=("24:0A:C4" "24:62:AB" "24:6F:28" "30:AE:A4" "3C:61:05" "3C:71:BF" "40:F5:20" "48:3F:DA" "54:43:B2" "58:BF:25" "68:67:25" "70:04:1D" "7C:9E:BD" "80:65:99" "84:0D:8E" "84:CC:A8" "84:F7:03" "8C:AA:B5" "94:B5:55" "94:B9:7E" "A0:20:A6" "A4:CF:12" "AC:67:B2" "B4:E6:2D" "BC:DD:C2" "C4:4F:33" "C8:2B:96" "CC:50:E3" "D8:A0:1D" "DC:4F:22" "E0:98:06" "E8:68:E7" "EC:94:CB" "F0:08:D1" "F4:CF:A2")

arp -a 2>/dev/null | grep -i "gardyn" && {
  echo "[!] GARDYN DEVICE DETECTED in ARP table"
  echo "VULNERABLE"
  exit 1
}

# Check for Espressif MACs (Gardyn uses ESP32)
FOUND=0
ARP_TABLE=$(arp -a 2>/dev/null || true)
for oui in "${ESP_OUIS[@]}"; do
  oui_lower=$(echo "$oui" | tr '[:upper:]' '[:lower:]')
  if echo "$SCAN_OUTPUT" | grep -qi "gardyn"; then
    FOUND=1
    break
  fi
done

# Also check mDNS for gardyn services
if command -v avahi-browse &>/dev/null; then
  MDNS_RESULT=$(timeout 5 avahi-browse -at 2>/dev/null | grep -i "gardyn" || true)
  if [ -n "$MDNS_RESULT" ]; then
    echo "[!] Gardyn mDNS service detected:"
    echo "$MDNS_RESULT"
    FOUND=1
  fi
elif command -v dns-sd &>/dev/null; then
  # macOS
  MDNS_RESULT=$(timeout 5 dns-sd -B _http._tcp 2>/dev/null | grep -i "gardyn" || true)
  if [ -n "$MDNS_RESULT" ]; then
    echo "[!] Gardyn mDNS service detected:"
    echo "$MDNS_RESULT"
    FOUND=1
  fi
fi

if [ "$FOUND" -eq 1 ]; then
  echo "[!] Gardyn device(s) detected on network $CIDR."
  echo "[!] Isolate these devices to a dedicated IoT VLAN."
  echo "VULNERABLE"
  exit 1
else
  echo "[+] No Gardyn devices detected on $CIDR."
  echo "[+] CVE-2026-28766 does not affect your enterprise network."
  echo "PATCHED"
  exit 0
fi