CVE-2026-28520 describes a single-byte buffer overflow (CWE-193) in the WiFiMulti component of arduino-TuyaOpen versions before 1.2.1, impacting smart hardware utilizing this library. Rated 8.4 HIGH, this vulnerability enables an attacker to execute arbitrary code on the affected embedded device if the victim's hardware connects to an attacker-controlled Wi-Fi access point. The attack requires low complexity and no user interaction or privileges. While the CVE is on a "Hot List" for monitoring, there is no public exploit code available, it is not in CISA's KEV catalog, and community discussion remains limited.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.2.1CPE matchmatch criteria | cpe:2.3:a:tuya:arduino-tuyaopen:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.5 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.