Tuya
6 CVEs across 6 Tuya products. Browse Tuya vulnerabilities, severities, and proof-of-concept exploits.
Tuya products with known CVEs
Tuya CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-28522 | Medium | 6.5 | 2026-03-16 | arduino-TuyaOpen before version 1.2.1 contains a null pointer dereference vulnerability in the WiFiUDP component. An attacker on the same local area network ca… |
CVE-2026-28521 | High | 7.7 | 2026-03-16 | arduino-TuyaOpen before version 1.2.1 contains an out-of-bounds memory read vulnerability in the TuyaIoT component. An attacker who hijacks or controls the Tuy… |
CVE-2026-28520 | High | 8.4 | 2026-03-16 | arduino-TuyaOpen before version 1.2.1 contains a single-byte buffer overflow vulnerability in the WiFiMulti component. When the victim's smart hardware connect… |
CVE-2026-28519 | High | 8.8 | 2026-03-16 | arduino-TuyaOpen before version 1.2.1 contains a heap-based buffer overflow vulnerability in the DnsServer component. An attacker on the same local area networ… |
CVE-2026-3465 | Low | 3.1 | 2026-03-03 | A vulnerability was determined in Tuya App and SDK 24.07.11 on Android. Affected by this vulnerability is an unknown functionality of the component JSON Data P… |
CVE-2025-56400 | High | 8.8 | 2025-11-24 | Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mob… |
CVE-2025-56557 | Critical | 9.1 | 2025-09-16 | An issue discovered in the Tuya Smart Life App 5.6.1 allows attackers to unprivileged control Matter devices via the Matter protocol. |
CVE-2024-3764 | Low | 2.7 | 2024-04-14 | ** DISPUTED ** A vulnerability classified as problematic has been found in Tuya SDK up to 5.0.x. Affected is an unknown function of the component MQTT Packet H… |