PT-2026-25552 · Tuya+1 · Arduino-Tuyaopen

Maxime Rossi Bellom · CVE-2026-28521 · Published 2026-03-15 · Updated 2026-03-16

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions arduino-TuyaOpen versions prior to 1.2.1

Description arduino-TuyaOpen before version 1.2.1 contains an out-of-bounds memory read issue in the TuyaIoT component. An attacker who gains control of the Tuya cloud service can send malicious DP event data to victim devices. This can lead to memory access outside of the intended boundaries, potentially resulting in information disclosure or a denial-of-service condition.

Recommendations Update arduino-TuyaOpen to version 1.2.1 or later.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-28521

Affected Products

Arduino-Tuyaopen

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28521.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-28521 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28521 · Security Note
• https://src.tuya.com/announcement/32 · Vendor Advisory
• https://github.com/tuya/arduino-TuyaOpen · Note
• https://t.me/CVEtracker/47435 · Telegram Post
• https://vulncheck.com/advisories/arduino-tuyaopen-tuyaiot-out-of-bounds-memory-read-information-disclosure · Note
• https://twitter.com/CVEnew/status/2033194266361823651 · Twitter Post