The vulnerability CVE-2026-28522 affects arduino-TuyaOpen versions prior to 1.2.1. It is caused by a null pointer dereference in the WiFiUDP component. An attacker with access to the same local area network can exploit this by sending a large volume of specially crafted UDP packets, which triggers the null pointer dereference and leads to a denial-of-service (DoS) condition. The CVSS 4.0 base score is 7.1, indicating a high severity with attack vector limited to adjacent network, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation results in a denial-of-service condition on devices using vulnerable versions of arduino-TuyaOpen, potentially causing service disruption or device unavailability. There is no indication of privilege escalation, data disclosure, or code execution from the provided data.

The vulnerability affects arduino-TuyaOpen versions before 1.2.1. Although no explicit patch link is provided, the description references version 1.2.1 as the fixed version. Users should upgrade to arduino-TuyaOpen version 1.2.1 or later to remediate this issue. Since this is not a cloud service, remediation is the responsibility of the user or device integrator. Patch status is not explicitly confirmed in vendor advisories; therefore, check the vendor's official resources for the latest updates and patches.