EUVD-2025-210766
GHSA-x6v7-jjvq-5rr9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker must be a credentialed member on the local Thread radio mesh (AV:A, PR:L); description confirms denial of service only, so C:N/I:N/A:H and unchanged scope.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
2DescriptionCVE.org
Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packets to cause a denial of service. These issues include triggerable assertion failures and a stack-based buffer overflow.
AnalysisAI
Denial of service in OpenThread, the open-source Thread networking stack embedded in Google Nest devices (identified as Nest 3.78.518349), lets an attacker who has already joined the same Thread mesh send crafted Mesh Link Establishment (MLE) packets that trigger reachable assertion failures and a stack-based buffer overflow, crashing affected nodes. The flaw carries a vendor CVSS 4.0 score of 10.0, though the description scopes real-world impact to denial of service rather than the code execution the score's high confidentiality/integrity metrics would imply. There is no public exploit identified at time of analysis and it is not on CISA KEV.
Technical ContextAI
The vulnerability lives in OpenThread's parsing of MLE (Mesh Link Establishment) protocol messages, the control-plane protocol Thread devices use to discover neighbors, establish links, and maintain the low-power 802.15.4-based mesh. Two root-cause classes are present even though NVD lists CWE as N/A: reachable/triggerable assertion failures (CWE-617), where malformed input drives the stack into an ASSERT that aborts the process, and a stack-based buffer overflow (CWE-121), where attacker-controlled length or field data is copied past a fixed stack buffer during MLE decoding. Affected products per the CPE (cpe:2.3:a:google:nest) are Google Nest smart-home devices that ship OpenThread as their Thread stack; the same upstream code is reused across many Thread-enabled IoT ecosystems.
RemediationAI
Apply Google's device firmware update as described in the vendor advisory (https://support.google.com/product-documentation/answer/17072818?hl=en&ref_topic=12974021); patch is available per vendor advisory though no exact fixed version string is specified in the provided data beyond the affected Nest 3.78.518349 build, so confirm the patched build number with Google. Ensure automatic updates are enabled on Nest devices so the fix lands without manual intervention. As compensating controls until updated, tightly guard the Thread network credential/commissioning secret so untrusted parties cannot join the mesh, avoid commissioning unknown devices, and where feasible segment or restrict which devices are on-boarded to the Thread network - trade-off is added operational friction when adding legitimate devices; note that no purely network-firewall control blocks an already-joined mesh member, so credential hygiene is the key mitigation.
File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Typ
Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Ra
A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fas
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today