Zephyr OpenThread CVE-2026-19741

Requires a firmware image built with CONFIG_OPENTHREAD_JOINER_AUTOSTART=y while CONFIG_OPENTHREAD_JOINER_PSKD was left at the removed default 'J01NME' (or any publicly known value), and a target device with no stored/commissioned operational dataset - i.e. factory-fresh, after a factory reset, or after a settings erase. The attacker must be within 802.15.4 radio range (AV:A) and operate a Thread commissioner registered with that same PSKd. Limiting factors that reduce real-world exposure: joiner autostart is NOT enabled by default and no in-tree Zephyr sample ships the vulnerable combination; exploitation is only possible during the device's uncommissioned joining window; and application-layer security using independently provisioned credentials still survives the network-layer takeover. The device remains mis-provisioned until reset.

Signals are mixed and net out below the raw 7.5/High CVSS headline. The CVSS vector itself is the main limiter: AV:A confines the attacker to 802.15.4 radio range (no internet-facing exposure), and AC:H reflects that the target must be caught in its uncommissioned joining window (factory-fresh, post-factory-reset, or post-settings-erase). PR:N/UI:N confirm no authentication or user interaction is needed once those conditions hold, and C:H/I:H/A:H is justified because a successful join makes the attacker the device's Thread router with full see/drop/inject/spoof control over its IPv6 traffic. The decisive mitigating factor is not in the CVSS base metrics at all: exposure is gated on an opt-in, non-default build configuration (CONFIG_OPENTHREAD_JOINER_AUTOSTART=y with the PSKd left at the public default), and the advisory confirms no in-tree Zephyr sample ships the vulnerable combination. No CISA KEV listing and no EPSS score are provided in the input, so there is no evidence of active or widespread exploitation; a full commissioner proof-of-concept is published in the GHSA advisory, which raises practical risk for any product that did ship the vulnerable combination. The vuln.today Decision label is this_week (not act_now/emergency). Net assessment: a genuine, high-impact misconfiguration-class weakness (CWE-1392, default credential) for the specific subset of products that enabled joiner autostart without overriding the PSKd, but not a broad-fleet emergency given it is off by default and adjacency-only.

An attacker standing within 802.15.4 radio range of a vulnerable Zephyr device that has just booted factory-fresh or been reset runs any stock Thread commissioner pre-registered with the public PSKd 'J01NME'. Because the device auto-starts a joiner and authenticates solely on that non-secret credential, the DTLS-PSK handshake succeeds and the attacker hands over an attacker-controlled operational dataset, making the device join the attacker's mesh. A complete commissioner PoC is published in the GHSA advisory; exploitation requires the device to be in its uncommissioned joining window.