{"id":"CVE-2026-19741","kind":"vulnerability","aliases":["CVE-2026-19741"],"related":[],"title":"Zephyr: default Thread joiner credential lets attackers commission devices","description":"Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default \"J01NME\" in modules/openthread/Kconfig.thread (previously subsys/net/l2/openthread/Kconfig, then subsys/net/l2/openthread/Kconfig.thread). J01NME is the example Joining Device Credential used throughout the public OpenThread and Thread commissioning documentation, including Zephyr's own samples/net/sockets/echo_client/README.rst, so it is not a secret. A firmware image built with CONFIG_OPENTHREAD_JOINER_AUTOSTART=y that never overrode the PSKd therefore shipped with a publicly known joining credential compiled in, with no build-time or run-time warning.\n\nThe PSKd is the only value that authenticates Thread commissioning: joiner and commissioner run a DTLS-PSK handshake keyed on it, after which the commissioner supplies the full operational dataset. In ot_configure_instance() (modules/openthread/openthread.c), a device with no stored dataset calls otJoinerStart() with the configured PSKd, and ot_joiner_start_handler() calls otThreadSetEnabled() on success. An unauthenticated attacker within 802.15.4 radio range of an uncommissioned device (factory-fresh, after a factory reset, or after a settings erase) can run any stock Thread commissioner registered with J01NME, complete the handshake, and hand the device an attacker-controlled operational dataset.\n\nThe device then joins and enables Thread on the attacker's mesh. The attacker becomes its router, seeing, dropping, injecting and spoofing all of the device's IPv6 traffic and impersonating the peers the application expects, while the device is cut off from the network it was meant to join and stays mis-provisioned until it is reset. Only application-layer security with independently provisioned credentials survives. Exposure is limited to builds that enable joiner autostart and leave the PSKd unset; the option is not enabled by default and no in-tree sample uses the vulnerable combination.\n\nThe fix removes the default from CONFIG_OPENTHREAD_JOINER_PSKD and adds a BUILD_ASSERT() in modules/openthread/openthread.c, active only under CONFIG_OPENTHREAD_JOINER_AUTOSTART, that fails the build unless a 6-to-32-character PSKd is configured. Products should provision a per-device PSKd from factory data and call otJoinerStart() from the application rather than relying on a credential compiled identically into every unit.","summary":"Zephyr's OpenThread integration shipped the public example joiner credential J01NME as the default PSKd, so builds with joiner autostart that never set their own PSKd accept a publicly known credential. An attacker within radio range of an uncommissioned device can join it to their own Thread mesh and hand it an attacker-controlled operational dataset.","severity":"high","cvss":7.5,"epss":0.00271,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","iot","openthread","runtime","thread","zephyr"],"not_affected_if":["custom-pskd-set","joiner-autostart-disabled","no-openthread"],"how_to_check":"- Check whether the build sets `CONFIG_OPENTHREAD_JOINER_AUTOSTART=y` and whether `CONFIG_OPENTHREAD_JOINER_PSKD` is set to a value of your own (the default `J01NME` is the vulnerable one).\n- Confirm the Zephyr version in use, for example with `west list zephyr` or the revision in `west.yml`, and compare it with the fixed release.","fix":"- Set `CONFIG_OPENTHREAD_JOINER_PSKD` to a per-device 6-to-32-character value provisioned from factory data, not the default.\n- Move to a Zephyr revision that includes the fix, which removes the default and adds a build assert requiring a PSKd under joiner autostart (exact fixed version: unknown).\n- Call `otJoinerStart()` from the application with a per-device credential instead of relying on autostart with a shared value.","status":"open","published_at":"2026-10-23T20:17:21+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:14:50+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-25T03:14:50Z","model":"claude-haiku-5-5","output":{"fix":"- Set `CONFIG_OPENTHREAD_JOINER_PSKD` to a per-device 6-to-32-character value provisioned from factory data, not the default.\n- Move to a Zephyr revision that includes the fix, which removes the default and adds a build assert requiring a PSKd under joiner autostart (exact fixed version: unknown).\n- Call `otJoinerStart()` from the application with a per-device credential instead of relying on autostart with a shared value.","reach":"network","title":"Zephyr: default Thread joiner credential lets attackers commission devices","impact":"high","summary":"Zephyr's OpenThread integration shipped the public example joiner credential J01NME as the default PSKd, so builds with joiner autostart that never set their own PSKd accept a publicly known credential. An attacker within radio range of an uncommissioned device can join it to their own Thread mesh and hand it an attacker-controlled operational dataset.","category":"runtime","nicknames":[],"who_cares":["zephyr","openthread","thread","iot","embedded"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker takes over device's Thread network and sees or alters its traffic","analyst_note":"Find the exact Zephyr release that contains the fix and the commit that removed the default, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-19741 and the linked Zephyr sources.","how_to_check":"- Check whether the build sets `CONFIG_OPENTHREAD_JOINER_AUTOSTART=y` and whether `CONFIG_OPENTHREAD_JOINER_PSKD` is set to a value of your own (the default `J01NME` is the vulnerable one).\n- Confirm the Zephyr version in use, for example with `west list zephyr` or the revision in `west.yml`, and compare it with the fixed release.","needs_analyst":true,"not_affected_if":["custom-pskd-set","joiner-autostart-disabled","no-openthread"],"who_is_affected":"Only products that enable OpenThread joiner autostart (`CONFIG_OPENTHREAD_JOINER_AUTOSTART=y`) and leave the PSKd unset are exposed, because the vulnerable default is only used in that case. Uncommissioned devices, including factory-fresh units, units after a factory reset, and units after a settings erase, are the ones an attacker can reach over the air. Teams that set their own PSKd or do not use joiner autostart can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000857,"input_tokens":4086,"output_tokens":896,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-19741':12A,15A '-2026':11A,14A '-32':393C '6':391C '802.15.4':220C 'accept':48B 'activ':378C 'add':372C 'applic':295C,322C,414C 'application-lay':321C 'assert':375C 'attack':7A,54B,75B,218C,257C,270C,274C 'attacker-control':74B,256C 'authent':166C 'autostart':41B,132C,338C,384C 'becom':275C 'build':38B,152C,334C,374C,388C 'build-tim':151C 'built':127C 'call':201C,212C,410C 'charact':394C 'combin':360C 'commiss':8A,111C,168C 'commission':171C,184C,244C 'compil':147C,421C 'complet':248C 'config':84C,129C,367C,381C 'configur':192C,205C,397C 'control':76B,258C 'credenti':5A,31B,52B,103C,146C,328C,420C 'cut':301C 'cve':10A,13A 'data':408C 'dataset':78B,189C,200C,260C 'default':2A,35B,89C,350C,365C 'defin':83C 'devic':9A,61B,102C,196C,226C,254C,262C,286C,299C,404C 'document':112C 'drop':279C 'dtls':175C 'dtls-psk':174C 'embed':16B 'enabl':266C,336C,348C 'eras':238C 'everi':424C 'exampl':29B,100C 'expect':296C 'exposur':330C 'factori':228C,232C,407C 'factory-fresh':227C 'fail':386C 'firmwar':125C 'fix':362C 'fresh':229C 'full':187C 'hand':71B,252C 'handler':211C 'handshak':177C,250C 'ident':422C 'imag':126C 'imperson':291C 'in-tre':353C 'includ':113C 'independ':326C 'inject':280C 'instanc':193C 'integr':25B,82C 'iot':17B 'ipv6':288C 'j01nme':32B,90C,97C,247C 'join':63B,101C,145C,264C,310C 'joiner':4A,30B,40B,86C,131C,169C,209C,337C,369C,383C 'key':178C 'known':51B,144C 'layer':323C 'leav':340C 'let':6A 'limit':332C 'meant':308C 'mesh':69B,272C 'mis':314C 'mis-provis':313C 'modules/openthread/kconfig.thread':92C 'modules/openthread/openthread.c':194C,377C 'network':305C 'never':43B,135C 'openthread':18B,24B,81C,85C,108C,130C,368C,382C 'oper':77B,188C,259C 'option':345C 'ot':191C,208C 'otjoinerstart':202C,411C 'otthreadseten':213C 'overrod':136C 'peer':293C 'per':403C 'per-devic':402C 'previous':93C 'product':398C 'provis':315C,327C,400C 'psk':176C 'pskd':36B,47B,87C,138C,160C,206C,342C,370C,395C,405C 'public':28B,50B,107C,143C 'radio':56B,221C 'rang':57B,222C 'rather':415C 'regist':245C 'reli':417C 'remov':363C 'reset':233C,319C 'router':277C 'run':156C,172C,240C 'run-tim':155C 'runtim':19B 'sampl':356C 'samples/net/sockets/echo_client/readme.rst':117C 'secret':123C 'secur':324C 'see':278C 'set':44B,237C 'ship':26B,140C 'spoof':282C 'start':210C 'stay':312C 'stock':242C 'store':199C 'subsys/net/l2/openthread/kconfig':94C 'subsys/net/l2/openthread/kconfig.thread':96C 'success':215C 'suppli':185C 'surviv':329C 'therefor':139C 'thread':3A,20B,68B,110C,167C,243C,267C 'throughout':105C 'time':153C,157C 'traffic':289C 'tree':355C 'unauthent':217C 'uncommiss':60B,225C 'unit':425C 'unless':389C 'unset':343C 'use':104C,357C 'valu':164C 'vulner':359C 'warn':158C 'within':55B,219C 'y':133C 'zephyr':1A,21B,22B,79C,114C","nicknames":[],"mitigations":[],"who_affected":"Only products that enable OpenThread joiner autostart (`CONFIG_OPENTHREAD_JOINER_AUTOSTART=y`) and leave the PSKd unset are exposed, because the vulnerable default is only used in that case. Uncommissioned devices, including factory-fresh units, units after a factory reset, and units after a settings erase, are the ones an attacker can reach over the air. Teams that set their own PSKd or do not use joiner autostart can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T20:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"vulnerabilities@zephyrproject.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19741","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19741","severity":null,"published_at":"2026-10-23T20:17:21+00:00","modified_at":"2026-10-23T20:17:21+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null},{"source":"epss","external_id":"CVE-2026-19741","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-19741","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}