CVSS 4.0
7.0 highCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:NCVE-2026-28521
High (7.0) in tuya arduino-tuyaopen. EPSS 0.2% chance of exploitation in the next 30 days.
arduino-TuyaOpen before version 1.2.1 contains an out-of-bounds memory read vulnerability in the TuyaIoT component. An attacker who hijacks or controls the Tuya cloud service can issue malicious DP event data to victim devices, causing out-of-bounds memory access that may result in information disclosure or a denial-of-service condition.
Severity
CVSS 3.1
7.7 highCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
- CWE
- CWE-125
- Published
- Modified
- Record from
- the NVD, synced
Affected
- tuya:arduino-tuyaopen