CVE-2026-28521: Tuya arduino-TuyaOpen, грешка в паметта

Описание

Оригинално описание

arduino-TuyaOpen before version 1.2.1 contains an out-of-bounds memory read vulnerability in the TuyaIoT component. An attacker who hijacks or controls the Tuya cloud service can issue malicious DP event data to victim devices, causing out-of-bounds memory access that may result in information disclosure or a denial-of-service condition.

Засегнати продукти

• Tuya arduino-TuyaOpen: преди 1.2.1

Вид слабост

• CWE-125 Четене извън границите на буфера

История

Други уязвимости в Tuya arduino-TuyaOpen

• 7.1CVE-2026-28522
• 8.8CVE-2026-28519
• 8.6CVE-2026-28520

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-28521
• https://nvd.nist.gov/vuln/detail/CVE-2026-28521
• https://src.tuya.com/announcement/32
• https://github.com/tuya/arduino-TuyaOpen
• https://www.vulncheck.com/advisories/arduino-tuyaopen-tuyaiot-out-of-bounds-memory-read-information-disclosure