Description
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID without checking the destination size. When MODULE_ATWINC15X0_DYNAMIC_CONNECT is enabled, a nearby attacker can advertise a malformed or oversized SSID that is processed during Wi-Fi scanning, causing memory corruption and potentially a hard fault, denial of service, or code execution. This issue is fixed in version 2026.04.
Published: 2026-10-16
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution via stack buffer overflow in the ATWINC15x0 driver
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a stack buffer overflow caused by an unsanitized strcpy in the _atwinc15x0_sta_set_current_ssid function of the ATWINC15x0 driver. An attacker who can broadcast a malformed or oversized SSID will cause memory corruption during Wi‑Fi scanning, leading to a hard, denial of service, or potentially arbitrary code execution. The flaw falls under CWE‑120 and CWE‑121 and could compromise the integrity and availability of the affected device.

Affected Systems

The issue is present in the RIOT operating system, specifically in the ATWINC15x0 driver used for Wi‑Fi connectivity. All releases prior to version 2026.04 are affected; devices running RIOT with the MODULE_ATWINC15X0_DYNAMIC_CONNECT option enabled are at risk.

Risk and Exploitability

The CVSS score of 9.6 indicates a high severity, and the exploit requires proximity to the target device to transmit an oversized SSID. No public exploit is documented, and the vulnerability is not listed in CISA KEV. Nonetheless, a nearby attacker can exploit the flaw during a normal scan, potentially causing a crash or executing arbitrary code if not mitigated.

Generated by OpenCVE AI on October 16, 2026 at 18:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the RIOT firmware to version 2026.04 or later, where the SSID copy is guarded.
  • If the dynamic connect feature is not required, disable MODULE_ATWINC15X0_DYNAMIC_CONNECT in the build configuration.
  • In environments where Wi‑Fi scans can be controlled, limit the device’s exposure to untrusted wireless signals or enforce stricter SSID validation at the application level as a temporary step.

Generated by OpenCVE AI on October 16, 2026 at 18:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 03:15:00 +0000

Type Values Removed Values Added
First Time appeared Riot-os
Riot-os riot
Vendors & Products Riot-os
Riot-os riot

Fri, 16 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID without checking the destination size. When MODULE_ATWINC15X0_DYNAMIC_CONNECT is enabled, a nearby attacker can advertise a malformed or oversized SSID that is processed during Wi-Fi scanning, causing memory corruption and potentially a hard fault, denial of service, or code execution. This issue is fixed in version 2026.04.
Title RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID
Weaknesses CWE-120
CWE-121
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Riot-os Riot
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-16T19:23:03.423Z

Reserved: 2026-09-29T16:10:04.077Z

Link: CVE-2026-102693

cve-icon Vulnrichment

Updated: 2026-10-16T19:22:58.175Z

cve-icon NVD

Status : Deferred

Published: 2026-10-16T17:17:17.173

Modified: 2026-10-16T20:17:17.397

Link: CVE-2026-102693

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T03:00:02Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  • CWE-121

    Stack-based Buffer Overflow