Tuya vulnerabilities
We track 4 vulnerabilities in Tuya products across 4 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on March 16, 2026.
Latest Tuya vulnerabilities
- 7.7 High severity
arduino-TuyaOpen: Out-of-bounds Read
arduino-TuyaOpen before version 1.2.1 contains an out-of-bounds memory read vulnerability in the TuyaIoT component. An attacker who hijacks or controls the Tuya cloud service can issue malicious DP event data to victim devices, causing out-of-bounds memory acc
- 8.4 High severity
arduino-TuyaOpen: Off-by-one Error
arduino-TuyaOpen before version 1.2.1 contains a single-byte buffer overflow vulnerability in the WiFiMulti component. When the victim's smart hardware connects to an attacker-controlled AP hotspot, the attacker can exploit the overflow to execute arbitrary co
- 8.8 High severity
arduino-TuyaOpen: Heap-based Buffer Overflow
arduino-TuyaOpen before version 1.2.1 contains a heap-based buffer overflow vulnerability in the DnsServer component. An attacker on the same local area network who controls the LAN DNS server can send malicious DNS responses to overflow the heap buffer, poten
- 8.8 High severity
Smartlife: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacke