Read the docs
TI-2026-75379 Aliases CVE-2026-102693

Stack buffer overflow in RIOT ATWINC15x0 driver via oversized SSID

Priority MEDIUM 42CWE-120Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

RIOT before 2026.04 is affected when the ATWINC15x0 driver is built with MODULE_ATWINC15X0_DYNAMIC_CONNECT enabled. The driver's _atwinc15x0_sta_set_current_ssid function copies the SSID with strcpy without checking the destination size, a stack-based buffer overflow (CWE-121). A nearby unauthenticated attacker can advertise a malformed or oversized SSID that is processed during Wi-Fi scanning, corrupting memory. Successful exploitation can cause a hard fault, denial of service or code execution.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID without checking the destination size. When MODULE_ATWINC15X0_DYNAMIC_CONNECT is enabled, a nearby attacker can advertise a malformed or oversized SSID that is processed during Wi-Fi scanning, causing memory corruption and potentially a hard fault, denial of service, or code execution. This issue is fixed in version 2026.04.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00226 13th percentileScored 2026-11-07
Fix Fixed RIOT (RIOT-OS): 2026.04

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
RIOT-OSRIOTbefore 2026.042026.04Patch availableCNA
  • RIOT VendorRIOT-OS Affected before 2026.04 Fixed in 2026.04 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:o:riot-os:riot:*:*:*:*:*:*:*:*——RIOT-OS
  • cpe:2.3:o:riot-os:riot:*:*:*:*:*:*:*:* Versions — — ·RIOT-OS

Remediation

Upgrade RIOT to version 2026.04, which fixes the ATWINC15x0 driver.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA RIOT (RIOT-OS) Fixed in 2026.04

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-102693
  2. 2026-10-18 CISA SSVC decision points changed

References

Other 3

  • TI-2024-21112 Buffer overflows in RIOT CVSS 3.1CRITICAL 9.8
  • TI-2023-16843 RIOT-OS vulnerable to Out of Bounds Write in _rbuf_add CVSS 3.1CRITICAL 9.8
  • TI-2023-10319 RIOT-OS vulnerable to Buffer Overflow during IPHC receive CVSS 3.1CRITICAL 9.8
  • TI-2026-22079 RIOT has an Out-of-Bounds Write in nanoCoAP Handler CVSS 3.1CRITICAL 9.8
  • TI-2023-16842 RIOT-OS vulnerable to Race Condition in SFR Timeout CVSS 3.1HIGH 7.5
  • TI-2023-16841 RIOT-OS vulnerable to NULL pointer dereference during NHC encoding CVSS 3.1HIGH 7.5
See all 45 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences