Vulnerability feed

Executive summary

The advisory says Zephyr's OpenThread integration shipped a publicly known default joining credential, "J01NME", that could let an unauthenticated attacker within radio range take over commissioning of an uncommissioned device. The advisory describes the consequence as a device joining an attacker-controlled network and remaining mis-provisioned until reset. The fix removes the default and requires a per-device credential, and the advisory recommends provisioning a unique credential per device from factory data. The advisory does not state a severity score.

Technical summary

This is a use of a hardcoded or publicly known default credential (CONFIG_OPENTHREAD_JOINER_PSKD defaulting to "J01NME") in the Thread commissioning handshake. The attack requires an attacker within 802.15.4 radio range of an uncommissioned device, such as one that is factory-fresh, freshly reset, or had its settings erased, and that is built with CONFIG_OPENTHREAD_JOINER_AUTOSTART=y without overriding the PSKd. The attacker can run a stock commissioner with that credential, complete the DTLS-PSK handshake, and supply a malicious operational dataset. The advisory states the option is not enabled by default and no in-tree sample uses the vulnerable combination. Affected and fixed version numbers are not stated, and no CVSS score, workaround beyond overriding the PSKd, or detection guidance is stated. The fix adds a BUILD_ASSERT() requiring a 6-to-32-character PSKd when joiner autostart is enabled.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

zephyrprojectZephyrOpenThreadzephyrproject zephyrZephyrOpenThread