CVE-2024-3764

CVE-2024-3764 describes a disputed denial-of-service vulnerability in the Tuya SDK up to version 5.0.x, specifically within an unknown function of its MQTT Packet Handler. The vendor notes that exploitation would require bypassing TLS or legitimate authentication, significantly limiting its real-world applicability. The vulnerability has a low CVSS score of 2.7, indicating low severity, with a network attack vector and low attack complexity, but requiring high privileges (PR:H) to initiate a denial of service. Its EPSS and FAUCET scores are very low, suggesting minimal real-world risk. There is no evidence of active exploitation, no public exploit code (Metasploit, Nuclei, ExploitDB), and no community discussion or media coverage, reinforcing its low threat profile. Upgrading to Tuya SDK version 5.1.0 mitigates this issue.