A critical out-of-bounds memory read vulnerability in the TuyaIoT component of arduino-TuyaOpen exposes affected devices to potential information disclosure and denial-of-service attacks.

This vulnerability is an out-of-bounds memory read (CWE-125) triggered when the TuyaIoT component processes malicious DP event data. An attacker who compromises or controls the Tuya cloud service can exploit this to read sensitive memory or crash the device, requiring no authentication from the attacker.

Successful exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive data residing in device memory or cause persistent denial-of-service conditions. Given the CVSS score of 7.7, this represents a high-severity risk to operational continuity and data confidentiality, particularly for deployments relying on Tuya-integrated IoT hardware.

Immediate Action: Update the arduino-TuyaOpen library to version 1.2.1 or later to implement the necessary memory bounds checking.

Proactive Monitoring: Monitor device stability and review system logs for recurring crashes or unexpected restarts that may indicate attempted exploitation of the TuyaIoT component.

Compensating Controls: Ensure that IoT devices are isolated within restricted network segments to limit the potential impact of a compromised cloud service provider.

Public Exploit Available: Unknown.

Organizations utilizing the arduino-TuyaOpen library should prioritize updating to version 1.2.1 to remediate this vulnerability. Given the nature of IoT devices, which may have limited update mechanisms, testing and deploying this patch should be treated with high urgency to prevent potential remote exploitation via the Tuya cloud ecosystem.