CVE-2026-102693

critical

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems.

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID without checking the destination size. When MODULE_ATWINC15X0_DYNAMIC_CONNECT is enabled, a nearby attacker can advertise a malformed or oversized SSID that is processed during Wi-Fi scanning, causing memory corruption and potentially a hard fault, denial of service, or code execution. This issue is fixed in version 2026.04.

CVSS

9.6

9.6 (CVSS v3.1)

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Severity source: NVD CVSS v3.1 (security-advisories@github.com)

Timeline (UTC)

Published: 2026-10-16 17:17

Modified: 2026-10-16 20:17

NVD status: Deferred

Last synced 1 day ago

Verified against the source API 2026-10-27 07:03 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

Not reported by the source (unknown — not "none").

Weakness classification (CWE)

CWE-120 CWE-121

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

No vendor advisory or patch reference tagged by NVD. Check the references below.

References

https://github.com/RIOT-OS/RIOT/commit/5209c1b84f9771342f079b7d5d94d8207fdd5f0a security-advisories@github.com
https://github.com/RIOT-OS/RIOT/releases/tag/2026.04 security-advisories@github.com
https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-gwgv-6976-hxrg security-advisories@github.com

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 07:03 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores