EUVD-2025-210766
GHSA-x6v7-jjvq-5rr9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessJoin target Thread mesh with credentials
-
DeliveryReach neighbor over 802.15.4 radio
-
ExploitSend crafted MLE packet
-
ExecutionTrigger assertion or stack overflow in parser
-
ImpactCrash or reboot Nest device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already be a member of the target's Thread mesh network - i.e., possess valid Thread network credentials and be within 802.15.4 radio range - and to send crafted MLE (Mesh Link Establishment) protocol packets to a device running the vulnerable OpenThread build (Google Nest 3.78.518349). Limiting factors: this is not internet-reachable despite the vendor's AV:N rating, since Thread is a local low-power wireless mesh; the description explicitly requires an authenticated on-network attacker, so a non-credentialed outsider cannot reach the vulnerable code path; and the confirmed outcome is denial of service (crash/reboot), not the code execution the raw CVSS metrics suggest. |
| Impact | The signals conflict and should be reconciled before treating this as a maximum-severity emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC/VI/VA and SC/SI/SA all High = 10.0) describes an unauthenticated, remote, full-compromise scope-changing flaw, but the prose describes 'an authenticated attacker on the same Thread network' achieving only 'denial of service' - so PR:N contradicts 'authenticated,' AV:N contradicts the adjacent-only nature of a local 802.15.4 Thread mesh, and the High confidentiality/integrity impacts contradict a DoS-only outcome. Realistically the attacker must already possess Thread network credentials and radio proximity, which sharply limits exposure to devices an adversary can reach on the mesh. No EPSS score, KEV listing, POC, or SSVC decision data was provided; absent active-exploitation evidence, this is a high-severity-on-paper issue whose practical priority is bounded by the credentialed, RF-adjacent access requirement. Verify the true attack vector and impact with Google before accepting the 10.0 rating. |
| Exploit ScenarioDerived | An attacker who has obtained Thread network credentials (for example a compromised or malicious commissioned device) and is within radio range of the mesh sends a specially crafted MLE packet to a neighboring Nest device, hitting an assertion or overflowing a stack buffer during message parsing and forcing the target to crash or reboot. Repeated packets sustain a denial-of-service condition against affected nodes. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 24, 2026
Denial of service in OpenThread, the open-source Thread networking stack embedded in Google Nest devices (identified as Nest 3.78.518349), lets an attacker who has already joined the same Thread mesh send crafted Mesh Link Establishment (MLE) packets that trigger reachable assertion failures and a stack-based buffer overflow, crashing affected nodes. The flaw carries a vendor CVSS 4.0 score of 10.0, though the description scopes real-world impact to denial of service rather than the code execution the score's high confidentiality/integrity metrics would imply. There is no public exploit identified at time of analysis and it is not on CISA KEV.
RemediationAI
Apply Google's device firmware update as described in the vendor advisory (https://support.google.com/product-documentation/answer/17072818?hl=en&ref_topic=12974021); patch is available per vendor advisory though no exact fixed version string is specified in the provided data beyond the affected Nest 3.78.518349 build, so confirm the patched build number with Google. Ensure automatic updates are enabled on Nest devices so the fix lands without manual intervention. As compensating controls until updated, tightly guard the Thread network credential/commissioning secret so untrusted parties cannot join the mesh, avoid commissioning unknown devices, and where feasible segment or restrict which devices are on-boarded to the Thread network - trade-off is added operational friction when adding legitimate devices; note that no purely network-firewall control blocks an already-joined mesh member, so credential hygiene is the key mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in OpenThread's parsing of MLE (Mesh Link Establishment) protocol messages, the control-plane protocol Thread devices use to discover neighbors, establish links, and maintain the low-power 802.15.4-based mesh. Two root-cause classes are present even though NVD lists CWE as N/A: reachable/triggerable assertion failures (CWE-617), where malformed input drives the stack into an ASSERT that aborts the process, and a stack-based buffer overflow (CWE-121), where attacker-controlled length or field data is copied past a fixed stack buffer during MLE decoding. Affected products per the CPE (cpe:2.3:a:google:nest) are Google Nest smart-home devices that ship OpenThread as their Thread stack; the same upstream code is reused across many Thread-enabled IoT ecosystems.
Know when Nest gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Attacker must be a credentialed member on the local Thread radio mesh (AV:A, PR:L); description confirms denial of service only, so C:N/I:N/A:H and unchanged scope.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
DescriptionCVE.org
Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packets to cause a denial of service. These issues include triggerable assertion failures and a stack-based buffer overflow.
Executive ViewAI
Google Nest devices running OpenThread 3.78.518349 contain CVE-2025-36939, a critical vulnerability enabling denial of service attacks from authenticated mesh network participants through crafted packets. Organizations deploying Nest for smart home or office automation risk operational disruption and service unavailability. The absence of vendor patches combined with CVSS 10.0 severity requires immediate access control hardening and inventory review.
No vendor-released patch identified at time of analysis. Implement Thread mesh access controls restricting device joins to pre-registered authorized devices; deploy network segmentation to isolate Thread infrastructure; establish comprehensive Thread protocol event logging and alerting for anomalous Mesh Link Establishment traffic; monitor device logs for unexpected crashes or disconnections indicating exploitation attempts; maintain detailed asset inventory for rapid patch deployment upon vendor release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
A remote, unauthenticated denial-of-service condition in the NestJS (Nest) microservices framework lets an attacker cras
Authentication and authorization bypass in NestJS affects only applications served through the Fastify adapter: @nestjs/
File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Typ
Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Ra
A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fas
Remote attackers can crash Nest.js applications (versions prior to 11.1.19) by sending approximately 47 KB of fragmented
Exploit-DB