Which versions of Arduino Tuyaopen are affected by CVE-2026-28522?

Organizations using arduino-TuyaOpen before version 1.2.1 should be aware of notable risk from CVE-2026-28522, a null pointer dereference vulnerability rated CVSS 6.5.. A patch is available.

How to fix or mitigate CVE-2026-28522?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Arduino Tuyaopen CVE-2026-28522

Q: What is the CVSS score of CVE-2026-28522?

CVE-2026-28522 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12229 HIGH

NULL Pointer Dereference (CWE-476)

2026-03-15 VulnCheck

Denial Of Service Null Pointer Dereference Arduino Tuyaopen

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 26, 2026 - 14:22 vuln.today

cvss_changed

Severity Changed

May 26, 2026 - 14:22 NVD

MEDIUM HIGH

CVSS changed

May 26, 2026 - 14:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

Patch available

Apr 16, 2026 - 05:29 EUVD

1.2.1

EUVD ID Assigned

Mar 15, 2026 - 14:00 euvd

EUVD-2026-12229

Analysis Generated

Mar 15, 2026 - 14:00 vuln.today

CVE Published

Mar 15, 2026 - 13:36 nvd

MEDIUM 6.5

DescriptionCVE.org

arduino-TuyaOpen before version 1.2.1 contains a null pointer dereference vulnerability in the WiFiUDP component. An attacker on the same local area network can send a large volume of malicious UDP packets to cause memory exhaustion on the device, triggering a null pointer dereference and resulting in a denial-of-service condition.

AnalysisAI

Arduino-TuyaOpen before version 1.2.1 contains a null pointer dereference vulnerability in its WiFiUDP component that allows unauthenticated attackers on the same local network to trigger a denial-of-service condition by flooding the device with malicious UDP packets. The vulnerability causes memory exhaustion leading to application crashes; while not actively exploited in the wild (KEV status unknown from provided data), the local network attack vector and high availability impact (CVSS 6.5) warrant prompt patching for affected IoT deployments.

Technical ContextAI

The vulnerability exists in the WiFiUDP networking component of the arduino-TuyaOpen library (CPE: cpe:2.3:a:tuya:arduino-tuyaopen:*:*:*:*:*:*:*:*), which provides UDP socket functionality for IoT devices running Arduino-compatible firmware. The root cause is classified as CWE-476 (Null Pointer Dereference), indicating that the WiFiUDP handler fails to validate or properly allocate memory when processing incoming UDP packets under load. When an attacker sends a large volume of UDP packets, the component exhausts available heap memory without proper error handling, leading to null pointer dereferences when the application attempts to access freed or unallocated memory regions. This is a memory safety issue common in C/C++-based embedded libraries where bounds checking and resource limits are insufficient.