CVE-2026-102693: RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's atwinc15x0stasetcurrentssid function uses strcpy to copy an SSID without checking the destination size. When MODULEATWINC15X0DYNAMICCONNECT is enabled, a nearby attacker can advertise a malformed or oversized SSID that is processed during Wi-Fi scanning, causing memory corruption and potentially a hard fault, denial of service, or code execution. This issue is fixed in version 2026.04.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RIOTto a version that resolves this vulnerability.Fixed in 2026.04
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
RIOT deployments using the ATWINC15x0 driver are exposed when MODULE_ATWINC15X0_DYNAMIC_CONNECT is enabled and the RIOT version is earlier than 2026.04. The attack can be performed by a nearby attacker through Wi-Fi scanning.
Does an attacker need credentials or user interaction?
No. The provided vector specifies no privileges and no user interaction, and exploitation involves advertising a malformed or oversized SSID that is processed during scanning.
What is the remediation?
Upgrade RIOT to version 2026.04, which fixes the issue. The affected function should not copy SSIDs into a fixed destination with strcpy without validating the destination size.