CVE-2026-28519
arduino-TuyaOpen DnsServer Heap-Based Buffer Overflow Remote Code Execution
- State
- Published
- Severity
- 8.7 High
- Published
- Mar 15, 2026
- Updated
- Mar 16, 2026
- Reserved
- Feb 27, 2026
Description
arduino-TuyaOpen before version 1.2.1 contains a heap-based buffer overflow vulnerability in the DnsServer component. An attacker on the same local area network who controls the LAN DNS server can send malicious DNS responses to overflow the heap buffer, potentially allowing execution of arbitrary code on affected embedded devices.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-122 Heap-based Buffer Overflow
Affected Products
| Product | Versions |
|---|---|
arduino-TuyaOpenTuya |
|
References
- Tuya SRC Security Advisoryvendor-advisory
- arduino-TuyaOpen GitHub Repositoryproduct
- VulnCheck Advisory: arduino-TuyaOpen DnsServer Heap-Based Buffer Overflow Remote Code Executionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.