The vulnerability is a null pointer dereference in the WiFiUDP component of arduino‑TuyaOpen firmware before version 1.2.1. An attacker on the same local area network can send a large volume of malicious UDP packets that trigger a null pointer dereference, resulting in a denial‑of‑service condition. The weakness is identified as CWE‑476: Null Pointer Dereference. The impact is a loss of availability for the affected device, potentially disrupting any services that rely on it.

Devices running Tuya’s arduino‑TuyaOpen firmware before version 1.2.1 are affected.

The CVSS score is 7.1, indicating a high severity vulnerability. The EPSS score is below 1%, suggesting a low likelihood of observed exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local network access and the ability to send high‑volume UDP traffic to the device. The attack vector is local network; no remote code execution or data theft is described.