RIOT-OS RIOT up to 2026.03 ATWINC15x0 driver _atwinc15x0_sta_set_current_ssid buffer overflow

Summaryinfo

A vulnerability identified as very critical has been detected in RIOT-OS RIOT up to 2026.03. This impacts the function _atwinc15x0_sta_set_current_ssid of the component ATWINC15x0 driver. Performing a manipulation results in buffer overflow. This vulnerability was named CVE-2026-102693. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as very critical has been found in RIOT-OS RIOT up to 2026.03. This affects the function _atwinc15x0_sta_set_current_ssid of the component ATWINC15x0 driver. The manipulation with an unknown input leads to a buffer overflow vulnerability. CWE is classifying the issue as CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID without checking the destination size. When MODULE_ATWINC15X0_DYNAMIC_CONNECT is enabled, a nearby attacker can advertise a malformed or oversized SSID that is processed during Wi-Fi scanning, causing memory corruption and potentially a hard fault, denial of service, or code execution. This issue is fixed in version 2026.04.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-102693 since 09/29/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/16/2026).

Upgrading to version 2026.04 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• RIOT-OS

Name

• RIOT

Version

• 2026.03

Website

• Product: https://github.com/RIOT-OS/RIOT/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion