CVE-2026-28520

High

Description

arduino-TuyaOpen before version 1.2.1 contains a single-byte buffer overflow vulnerability in the WiFiMulti component. When the victim's smart hardware connects to an attacker-controlled AP hotspot, the attacker can exploit the overflow to execute arbitrary code on the affected embedded device.

SeverityHigh

CVSS8.4

Exploit probability—

ProductArduino-tuyaopen

PublishedMar 16, 2026

First seenMar 16, 2026

Weakness typeCWE-193CWE-193

How to fix

Update

tuya arduino-tuyaopen1.2.1 or later

Vendor advisories

src.tuya.com/announcement/32

Affected products

Product	Affected versions	Fixed in
tuya arduino-tuyaopen	v < 1.2.1	1.2.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.