The vulnerability is a null pointer dereference in the WiFiUDP module of arduino‑TuyaOpen. An attacker on the same local area network can flood the device with a large volume of malicious UDP packets, causing memory exhaustion. The resulting null pointer dereference triggers a denial‑of‑service, making the device unavailable. The weakness is identified as CWE-476: Null Pointer Dereference. The impact is loss of availability for the affected device, potentially disrupting any services that rely on it.

Devices running Tuya’s arduino‑TuyaOpen firmware before version 1.2.1 are affected. The product is identified by the CPE cpe:2.3:a:tuya:arduino-tuyaopen:*:*:*:*:*:*:*:*.

The CVSS score is 7.1, indicating a high severity vulnerability. The EPSS score is below 1%, suggesting a low likelihood of observed exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local network access and the ability to send high‑volume UDP traffic to the device. The attack vector is local network; no remote code execution or data theft is described.