EUVD-2026-12228CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Lifecycle Timeline
6DescriptionNVD
arduino-TuyaOpen before version 1.2.1 contains an out-of-bounds memory read vulnerability in the TuyaIoT component. An attacker who hijacks or controls the Tuya cloud service can issue malicious DP event data to victim devices, causing out-of-bounds memory access that may result in information disclosure or a denial-of-service condition.
AnalysisAI
CVE-2026-28521 is an out-of-bounds memory read vulnerability in the TuyaIoT component of arduino-TuyaOpen library versions prior to 1.2.1, affecting IoT devices using Tuya's cloud platform. An attacker who compromises or controls the Tuya cloud service can send malformed DP (data point) events to trigger memory disclosure or denial-of-service conditions. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all IoT devices and systems using arduino-TuyaOpen library versions prior to 1.2.1. Within 7 days: Upgrade affected devices to arduino-TuyaOpen 1.2.1 or later; test in non-production environment first. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today