{"id":"CVE-2026-28520","summary":"arduino-TuyaOpen WiFiMulti Single-Byte Buffer Overflow Remote Code Execution","details":"arduino-TuyaOpen before version 1.2.1 contains a single-byte buffer overflow vulnerability in the WiFiMulti component. When the victim's smart hardware connects to an attacker-controlled AP hotspot, the attacker can exploit the overflow to execute arbitrary code on the affected embedded device.","modified":"2026-08-12T15:32:11.663641Z","published":"2026-03-15T13:35:42.482Z","database_specific":{"cwe_ids":["CWE-193"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28520.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28520.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28520"},{"type":"ADVISORY","url":"https://src.tuya.com/announcement/32"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/arduino-tuyaopen-wifimulti-single-byte-buffer-overflow-remote-code-execution"},{"type":"PACKAGE","url":"https://github.com/tuya/arduino-TuyaOpen"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tuya/arduino-tuyaopen","events":[{"introduced":"0"},{"fixed":"1712806afe66fa2abe787ddf8cdb0e53f49ed96c"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.2.1"}],"source":["AFFECTED_FIELD","CPE_RANGE"],"cpe":"cpe:2.3:a:tuya:arduino-tuyaopen:*:*:*:*:*:*:*:*"}}],"versions":["1.2.0","1.1.9","1.1.8","1.1.7","1.1.6","1.1.5","1.1.4","1.1.3","1.1.2","1.1.1","1.1.0","1.0.3","1.0.2","1.0.1","1.0.0","0.0.4","0.0.3","global","0.0.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28520.json","vanir_signatures_modified":"2026-08-12T15:32:11Z","vanir_signatures":[{"digest":{"function_hash":"35339061321589632932171406056722236442","length":241},"id":"CVE-2026-28520-15a3642e","signature_type":"Function","signature_version":"v1","source":"https://github.com/tuya/arduino-tuyaopen/commit/1712806afe66fa2abe787ddf8cdb0e53f49ed96c","target":{"file":"cores/tuya_open/tuya_app_main.c","function":"tuya_app_main"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/tuya/arduino-tuyaopen/commit/1712806afe66fa2abe787ddf8cdb0e53f49ed96c","target":{"file":"cores/tuya_open/tuya_app_main.c","function":"app_open_sdk_init"},"deprecated":false,"digest":{"length":624,"function_hash":"339681762992278317836038670379132180264"},"id":"CVE-2026-28520-20965f93"},{"source":"https://github.com/tuya/arduino-tuyaopen/commit/1712806afe66fa2abe787ddf8cdb0e53f49ed96c","target":{"file":"libraries/TuyaIoT/src/TuyaIoT.cpp"},"deprecated":false,"digest":{"line_hashes":["194359451344183338622208622591928545213","154701627822890261176436257489988882276","127340910170432909922303014673800644066","314551761760421513250537235208057793214","297198778696204573490905265517791861921","205079730317756643793406493237618454423","216200924144760417129861083690758779699","299086485031529851372843085194420344056"],"threshold":0.9},"id":"CVE-2026-28520-86c1f5a8","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/tuya/arduino-tuyaopen/commit/1712806afe66fa2abe787ddf8cdb0e53f49ed96c","target":{"file":"libraries/TuyaIoT/src/TuyaIoT.cpp","function":"TuyaIoTCloudClass::uartAuthInit"},"deprecated":false,"digest":{"function_hash":"228376957563261250250323542310764060167","length":141},"id":"CVE-2026-28520-a532c698","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/tuya/arduino-tuyaopen/commit/1712806afe66fa2abe787ddf8cdb0e53f49ed96c","target":{"file":"cores/tuya_open/tuya_app_main.c","function":"ArduinoThread"},"deprecated":false,"digest":{"length":412,"function_hash":"93408165737688110381178319758432194100"},"id":"CVE-2026-28520-a9ee429d"},{"target":{"file":"cores/tuya_open/tuya_app_main.c"},"deprecated":false,"digest":{"line_hashes":["111002027523529430165214499337533858255","321222107020963642537475106455708529566","114793625497611877257020758582591167117","85147159063347037920855839645972837721","122876489708497389863253870811302714898","186633455858800647837972764082670996163","260018632668019599036932807639221307533","243792348152715600219857031707048251536","131778133239169255758495386960328441692","258623905542365265942026793827399340622","290339756397933325316802769427471948747","211201213007954943571599682875827404419","136564073643278925125167076826882036317","40438577432183700989303279624905867037","111136637917233513941512870603071453355","161452998591767123238495747428234810561","221521972120789712207169709268343971758","311145983598839541522785901911962184078","112047612856236419077163716352223227658"],"threshold":0.9},"id":"CVE-2026-28520-de242646","signature_type":"Line","signature_version":"v1","source":"https://github.com/tuya/arduino-tuyaopen/commit/1712806afe66fa2abe787ddf8cdb0e53f49ed96c"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}