RIOT: Stack buffer overflow in ATWINC15x0 Wi-Fi driver

Summary

The ATWINC15x0 Wi-Fi driver of RIOT, an open-source operating system for IoT and other embedded devices, is affected when the module MODULE_ATWINC15X0_DYNAMIC_CONNECT is enabled. A nearby attacker within radio range can advertise a malformed or oversized SSID that is processed during Wi-Fi scanning. This corrupts memory and can lead to a hard fault, denial of service or code execution. No authentication or user interaction is required.

Affected

• RIOT versions before 2026.04
• Only builds with MODULE_ATWINC15X0_DYNAMIC_CONNECT enabled
• VulDB describes the range as up to 2026.03; the vendor range should be confirmed against the advisory

Fixed in

• RIOT 2026.04 (fix commit 5209c1b84f9771342f079b7d5d94d8207fdd5f0a, which replaces strcpy with a bounded copy)
• Use the latest RIOT release where possible

Workaround

• No vendor-published workaround.
• Unverified inference: builds that do not need MODULE_ATWINC15X0_DYNAMIC_CONNECT may not be affected. Verify against the GHSA advisory before relying on this.

Exploitation

• No public proof of concept confirmed at the time of research.
• Not listed in CISA KEV at the time of the report (KEV not checked directly).
• EPSS about 0.2%.
• An unverified aggregator claims a public PoC; this is not confirmed by a primary source.

Our recommendation

• Ask device and integration vendors whether their firmware uses RIOT and, if so, which version.
• Upgrade RIOT-based firmware to 2026.04 or later and confirm the fix against the commit.
• If the dynamic connect module is not required, consider removing it after verification.
• Limit exposure of Wi-Fi-enabled devices in shared or public spaces and monitor the NVD entry for updates.
• Practical relevance is low for most SMEs, which rarely run RIOT directly.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Fix commit 5209c1b github.com
• RIOT release 2026.04 github.com
• GitHub Security Advisory GHSA-gwgv-6976-hxrg github.com
• Vulners CVE record vulners.com
• VulDB entry 421353 vuldb.com
• Strix CVE summary www.strix.ai
• RIOT changelog 2026.04 doc.riot-os.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:45.