Vendors / Tuya Records 8 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 5
Exploited now Tuya records in CISA KEV No Tuya vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 47
An issue discovered in the Tuya Smart Life App 5.6.1 allows attackers to unprivileged control Matter devices via the Matter protocol.
CVSS 3.1 CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00312 · Published 2025-09-16 · No fix listed CWE-250
Priority MEDIUM 47
** DISPUTED ** A vulnerability classified as problematic has been found in Tuya SDK up to 5.0.x.
CVSS 3.1 LOW 2.7· Network · High privileges · No interaction · EPSS 0.00587 · Published 2024-04-14 · No fix listed CWE-404
Priority MEDIUM 45
A vulnerability was determined in Tuya App and SDK 24.07.11 on Android.
CVSS 4.0 LOW 2.3· Network · No auth · User interaction · EPSS 0.00336 · Published 2026-03-03 · No fix listed CWE-404
Priority MEDIUM 40
arduino-TuyaOpen before version 1.2.1 contains a heap-based buffer overflow vulnerability in the DnsServer component.
CVSS 4.0 HIGH 8.7· Adjacent network · No auth · No interaction · EPSS 0.00393 · Published 2026-03-15 · Fixed in 1.2.1 CWE-122
Priority LOW 39
arduino-TuyaOpen before version 1.2.1 contains a single-byte buffer overflow vulnerability in the WiFiMulti component.
CVSS 4.0 HIGH 8.6· Local · No auth · No interaction · EPSS 0.00201 · Published 2026-03-15 · Fixed in 1.2.1 CWE-193
Priority LOW 39
Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications t…
CVSS 3.1 HIGH 8.8· Network · No auth · User interaction · EPSS 0.00183 · Published 2025-11-24 · No fix listed CWE-352
Priority LOW 31
arduino-TuyaOpen before version 1.2.1 contains a null pointer dereference vulnerability in the WiFiUDP component.
CVSS 4.0 HIGH 7.1· Adjacent network · No auth · No interaction · EPSS 0.00269 · Published 2026-03-15 · Fixed in 1.2.1 CWE-476
Priority LOW 30
arduino-TuyaOpen before version 1.2.1 contains an out-of-bounds memory read vulnerability in the TuyaIoT component.
CVSS 4.0 HIGH 7.0· Local · No auth · No interaction · EPSS 0.00225 · Published 2026-03-15 · Fixed in 1.2.1 CWE-125
Open these records in search → All records by CVSS severity
1 5 0 2 0
THREATIST.IORead the docs