


Perceptive Security
SOC/SIEM Consultancy

arduino-TuyaOpen before version 1.2.1 contains a single-byte buffer overflow vulnerability in the WiFiMulti component. When the victim's smart hardware connects…
Published:
15 maart 2026 om 23:00:00
Alert date:
16 maart 2026 om 16:21:26
Source:
nvd.nist.gov
Mobile & IoT, Supply Chain & Dependencies
Arduino-TuyaOpen versions before 1.2.1 contain a single-byte buffer overflow vulnerability in the WiFiMulti component. The vulnerability can be exploited when victim's smart hardware connects to an attacker-controlled WiFi access point. Attackers can leverage this overflow to achieve arbitrary code execution on the affected embedded device. This represents a significant security risk for IoT devices using the vulnerable arduino-TuyaOpen library. The vulnerability affects the WiFi connection management functionality specifically.
Technical details
Mitigation steps:
Affected products:
arduino-TuyaOpen
Related links:
https://nvd.nist.gov/vuln/detail/CVE-2026-28520
https://github.com/tuya/arduino-TuyaOpen
https://src.tuya.com/announcement/32
https://www.vulncheck.com/advisories/arduino-tuyaopen-wifimulti-single-byte-buffer-overflow-remote-code-execution
Related CVE's:
Related threat actors:
IOC's:
This article was created with the assistance of AI technology by Perceptive.
