Live › vulnerability › CVE-2026-102693
Go to dashboardRIOT, an open-source OS for embedded IoT devices, has an unchecked strcpy in its ATWINC15x0 Wi-Fi driver that copies an SSID into a fixed buffer. A nearby attacker advertising an oversized SSID can corrupt memory, causing a crash or potentially code execution on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check whether the firmware is built with MODULE_ATWINC15X0_DYNAMIC_CONNECT enabled and which RIOT version it uses (prior to 2026.04 is affected).
Upgrade RIOT to 2026.04 or later and rebuild the firmware.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID without checking the destination size. When MODULE_ATWINC15X0_DYNAMIC_CONNECT is enabled, a nearby attacker can advertise a malformed or oversized SSID that is processed during Wi-Fi scanning, causing memory corruption and potentially a hard fault, denial of service, or code execution. This issue is fixed in version 2026.04.
This page as .md · .json · in your agent: get_signal("CVE-2026-102693")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.