CVE-2026-28519

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28519", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-02-27T21:07:55.466Z", "datePublished": "2026-03-15T13:36:47.991Z", "dateUpdated": "2026-03-16T14:20:19.096Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-03-15T13:36:47.991Z"}, "datePublic": "2026-03-11T00:00:00.000Z", "title": "arduino-TuyaOpen DnsServer Heap-Based Buffer Overflow Remote Code Execution", "descriptions": [{"lang": "en", "value": "arduino-TuyaOpen before version 1.2.1 contains a heap-based buffer overflow vulnerability in the DnsServer component. An attacker on the same local area network who controls the LAN DNS server can send malicious DNS responses to overflow the heap buffer, potentially allowing execution of arbitrary code on affected embedded devices."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Heap-based Buffer Overflow", "cweId": "CWE-122", "type": "CWE"}]}], "affected": [{"vendor": "Tuya", "product": "arduino-TuyaOpen", "versions": [{"version": "0", "lessThan": "1.2.1", "status": "affected", "versionType": "semver"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 8.7, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://src.tuya.com/announcement/32", "name": "Tuya SRC Security Advisory", "tags": ["vendor-advisory"]}, {"url": "https://github.com/tuya/arduino-TuyaOpen", "name": "arduino-TuyaOpen GitHub Repository", "tags": ["product"]}, {"name": "VulnCheck Advisory: arduino-TuyaOpen DnsServer Heap-Based Buffer Overflow Remote Code Execution", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/arduino-tuyaopen-dnsserver-heap-based-buffer-overflow-remote-code-execution"}], "x_generator": {"engine": "vulncheck"}, "credits": [{"lang": "en", "value": "Maxime ROSSI BELLOM", "type": "finder"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28519", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-16T14:13:03.068394Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T14:20:19.096Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28519", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-16T14:13:03.068394Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T14:17:31.261Z"}}], "cna": {"title": "arduino-TuyaOpen DnsServer Heap-Based Buffer Overflow Remote Code Execution", "credits": [{"lang": "en", "type": "finder", "value": "Maxime ROSSI BELLOM"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Tuya", "product": "arduino-TuyaOpen", "versions": [{"status": "affected", "version": "0", "lessThan": "1.2.1", "versionType": "semver"}]}], "datePublic": "2026-03-11T00:00:00.000Z", "references": [{"url": "https://src.tuya.com/announcement/32", "name": "Tuya SRC Security Advisory", "tags": ["vendor-advisory"]}, {"url": "https://github.com/tuya/arduino-TuyaOpen", "name": "arduino-TuyaOpen GitHub Repository", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/arduino-tuyaopen-dnsserver-heap-based-buffer-overflow-remote-code-execution", "name": "VulnCheck Advisory: arduino-TuyaOpen DnsServer Heap-Based Buffer Overflow Remote Code Execution", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "arduino-TuyaOpen before version 1.2.1 contains a heap-based buffer overflow vulnerability in the DnsServer component. An attacker on the same local area network who controls the LAN DNS server can send malicious DNS responses to overflow the heap buffer, potentially allowing execution of arbitrary code on affected embedded devices."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-03-15T13:36:47.991Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28519", "state": "PUBLISHED", "dateUpdated": "2026-03-16T14:20:19.096Z", "dateReserved": "2026-02-27T21:07:55.466Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-03-15T13:36:47.991Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "arduino-TuyaOpen", "vendor": "Tuya", "versions": [{"lessThan": "1.2.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tuya:arduino-tuyaopen:*:*:*:*:*:*:*:*", "matchCriteriaId": "8DCD3B50-3018-4B34-AB9B-16C0FB32AF4A", "versionEndExcluding": "1.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "arduino-TuyaOpen before version 1.2.1 contains a heap-based buffer overflow vulnerability in the DnsServer component. An attacker on the same local area network who controls the LAN DNS server can send malicious DNS responses to overflow the heap buffer, potentially allowing execution of arbitrary code on affected embedded devices."}, {"lang": "es", "value": "arduino-TuyaOpen antes de la versi\u00f3n 1.2.1 contiene una vulnerabilidad de desbordamiento de b\u00fafer basado en mont\u00edculo en el componente DnsServer. Un atacante en la misma red de \u00e1rea local que controla el servidor DNS de la LAN puede enviar respuestas DNS maliciosas para desbordar el b\u00fafer del mont\u00edculo, lo que podr\u00eda permitir la ejecuci\u00f3n de c\u00f3digo arbitrario en los dispositivos embebidos afectados."}], "id": "CVE-2026-28519", "lastModified": "2026-06-17T10:28:47.253", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28519", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T14:13:03.068394Z", "version": "2.0.3"}}]}, "published": "2026-03-16T14:19:28.127", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://github.com/tuya/arduino-TuyaOpen"}, {"source": "disclosure@vulncheck.com", "tags": ["Vendor Advisory"], "url": "https://src.tuya.com/announcement/32"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/arduino-tuyaopen-dnsserver-heap-based-buffer-overflow-remote-code-execution"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.2.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "arduino-TuyaOpen", "source": "cna", "vendor": "Tuya"}, "product": "arduino-tuyaopen", "vendor": "tuya"}], "analysis": {"en": {"generated_at": "2026-03-17T16:51:21.408810+00:00", "value": {"mitigation_remediation": ["Upgrade to Tuya arduino\u2011TuyaOpen firmware version 1.2.1 or later.", "If an upgrade is not immediately possible, isolate the device from the local DNS network or disable the DnsServer component.", "Configure the LAN DNS server to block or rate\u2011limit responses to the affected device.", "Monitor the device and network for unusual DNS traffic or signs of exploitation."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Affected products are Tuya\u2019s arduino\u2011TuyaOpen firmware versions prior to 1.2.1. The vulnerability is identified by the CPE string cpe:2.3:a:tuya:arduino-tuyaopen:*:*:*:*:*:*:*:* and applies to all derivatives of this firmware that include the DnsServer component. No single affected version beyond 1.2.1 is listed, so firmware updates equal or newer than 1.2.1 are presumed safe.", "description_and_impact": "This vulnerability is a heap-based buffer overflow in the DnsServer component of the arduino\u2011TuyaOpen firmware. An attacker who can control the local network DNS server can send malicious DNS responses that overflow the heap buffer, potentially allowing the attacker to execute arbitrary code on the affected embedded device. The flaw results in full remote code execution, giving an attacker control over the device\u2019s operating system or firmware.", "risk_and_exploitability": "The CVSS score of 8.7 marks this as a high\u2011severity flaw. The EPSS score of less than 1% indicates low current exploitation probability, but the vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires local network access and control of the LAN DNS server, making it a LAN\u2011based attack. If an attacker can reach the device from the local network and manipulate DNS traffic, they can trigger the buffer overflow and gain code execution. Until a patch is applied, the risk remains significant for devices exposed to a potentially compromised local DNS environment."}}}}, "created": "2026-03-16T09:21:35.248238+00:00", "updated": "2026-03-23T14:01:41.349417+00:00", "vendors": ["tuya", "tuya$PRODUCT$arduino-tuyaopen"]}