Tuya

6 CVEs across 6 Tuya products. Browse Tuya vulnerabilities, severities, and proof-of-concept exploits.

Tuya products with known CVEs

ProductCVEs
Arduino-Tuyaopen4
Sdk2
Tuya2
App1
Smartlife1
Tuya Smart1
Tuya CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-28522Medium6.52026-03-16arduino-TuyaOpen before version 1.2.1 contains a null pointer dereference vulnerability in the WiFiUDP component. An attacker on the same local area network ca…
CVE-2026-28521High7.72026-03-16arduino-TuyaOpen before version 1.2.1 contains an out-of-bounds memory read vulnerability in the TuyaIoT component. An attacker who hijacks or controls the Tuy…
CVE-2026-28520High8.42026-03-16arduino-TuyaOpen before version 1.2.1 contains a single-byte buffer overflow vulnerability in the WiFiMulti component. When the victim's smart hardware connect…
CVE-2026-28519High8.82026-03-16arduino-TuyaOpen before version 1.2.1 contains a heap-based buffer overflow vulnerability in the DnsServer component. An attacker on the same local area networ…
CVE-2026-3465Low3.12026-03-03A vulnerability was determined in Tuya App and SDK 24.07.11 on Android. Affected by this vulnerability is an unknown functionality of the component JSON Data P…
CVE-2025-56400High8.82025-11-24Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mob…
CVE-2025-56557Critical9.12025-09-16An issue discovered in the Tuya Smart Life App 5.6.1 allows attackers to unprivileged control Matter devices via the Matter protocol.
CVE-2024-3764Low2.72024-04-14** DISPUTED ** A vulnerability classified as problematic has been found in Tuya SDK up to 5.0.x. Affected is an unknown function of the component MQTT Packet H…