CVE-2026-28522

arduino-TuyaOpen before version 1.2.1 contains a null pointer dereference vulnerability in the WiFiUDP component. An attacker on the same local area network can send a large volume of malicious UDP packets to cause memory exhaustion on the device, triggering a null pointer dereference and resulting in a denial-of-service condition.

Weakness

The product dereferences a pointer that it expects to be valid but is NULL.

Affected Software

Potential Mitigations

References

• https://github.com/tuya/arduino-TuyaOpen
• https://src.tuya.com/announcement/32
• https://www.vulncheck.com/advisories/arduino-tuyaopen-wifiudp-null-pointer-dereference-denial-of-service