The vulnerability is a single-byte buffer overflow in the WiFiMulti component of the arduino-TuyaOpen firmware before version 1.2.1. The flaw allows an attacker to overflow a local buffer and execute arbitrary code on the device, giving full control over the embedded hardware. The weakness is identified as CWE-193 and carries a high-severity CVSS score of 8.6, indicating substantial risk to device confidentiality, integrity, and availability.

The affected product is arduino-TuyaOpen from Tuya. All firmware versions prior to 1.2.1 are vulnerable. No other versions are reported to be affected.

The CVSS score of 8.6 denotes high severity, but the EPSS score of less than 1 % suggests a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the target device to connect to an attacker-controlled Wi-Fi access point. When a device associates with such a hotspot, the attacker can send a specially crafted packet that triggers the buffer overflow, enabling arbitrary code execution on the compromised device.