Vulnerability in Zephyr's OpenThread Integration Affecting Devices with Default Security Credentials

CVE-2026-19741

What is CVE-2026-19741?

Zephyr's OpenThread integration contains a significant vulnerability where a default pre-shared key (PSKd) is set as 'J01NME', leaving devices susceptible to exploitation. This default credential is publicly documented and can facilitate unauthorized access. An attacker within radio range can impersonate a legitimate commissioning device to gain control over affected devices, ultimately disrupting their intended network operations. Without proper configuration of unique per-device PSKd, affected devices remain vulnerable until manually reset. To mitigate this issue, it is crucial for manufacturers to provision devices with unique credentials and ensure that no default keys are compiled into firmware.

References