RIOT OS EUVD-2026-102946

Exploitation requires the firmware to be built with MODULE_ATWINC15X0_DYNAMIC_CONNECT enabled and to use the ATWINC15x0 Wi-Fi driver; without that module the vulnerable _atwinc15x0_sta_set_current_ssid path is not reached. The attacker must be within Wi-Fi radio range (CVSS AV:A, adjacent) to advertise the malformed/oversized SSID, and the target device must perform a Wi-Fi scan that processes the attacker-controlled SSID. No authentication is required (PR:N) and no explicit user interaction is needed (UI:N) if scanning occurs automatically. Limiting factors: physical/RF proximity, the non-default build-time module dependency, and reliance on the device actively scanning; affects RIOT versions prior to 2026.04.

The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, base 9.6) describes an adjacent-network, low-complexity, unauthenticated flaw with scope change and full CIA impact - on paper a critical issue. However, several signals temper real-world urgency. There is no EPSS score, no CISA KEV listing, and no public POC provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis.' The attack vector is AV:A (adjacent/Wi-Fi radio proximity), not AV:N, meaning an attacker must be within wireless range of the target device rather than exploiting it across the internet - a meaningful limiter for mass exploitation. Exploitation is further gated by the compile-time condition that MODULE_ATWINC15X0_DYNAMIC_CONNECT be enabled, so only a subset of deployments using the ATWINC15x0 Wi-Fi driver with dynamic connect are affected. The source-code evidence strongly confirms the root cause: an unbounded strcpy of an attacker-controlled SSID into a fixed-size buffer, replaced by bounded strscpy in the fix, consistent with CWE-120. The S:C (scope change) rating is debatable for an on-device memory-corruption bug and should be treated cautiously (see assessed vector). Net: a genuinely serious memory-corruption bug worth patching on affected embedded fleets, but the adjacency requirement, build-flag dependency, niche product footprint, and absence of known exploitation make this a priority-to-patch rather than an emergency mass-exploitation threat.

An attacker within Wi-Fi radio range of a RIOT-based IoT device (built with MODULE_ATWINC15X0_DYNAMIC_CONNECT) broadcasts a beacon or probe response advertising a malformed, oversized SSID. When the device performs a Wi-Fi scan, _atwinc15x0_sta_set_current_ssid copies the oversized SSID with strcpy into a fixed-size buffer, overflowing it and corrupting adjacent memory, which can trigger a hard fault / denial of service and potentially arbitrary code execution. No public exploit code is identified at time of analysis, though the fix commit publicly reveals the vulnerable call site.