CVE-2023-2626 Authentication Bypass in OpenThread Boarder Router devices
Unauthenticated attackers can bypass security checks to send arbitrary IPv6 packets to devices on the local network via OpenThread border routers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-2626?
CVE-2023-2626 is a high-severity authentication bypass vulnerability in Google Wifi (next gen), published on 25 Jul 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
There exists an authentication bypass vulnerability in OpenThread border router devices and implementations. This issue allows unauthenticated nodes to craft radio frames using “Key ID Mode 2”: a special mode using a static encryption key to bypass security checks, resulting in arbitrary IP packets being allowed on the Thread network. This provides a pathway for an attacker to send/receive arbitrary IPv6 packets to devices on the LAN, potentially exploiting them if they lack additional authentication or contain any network vulnerabilities that would normally be mitigated by the home router’s NAT firewall. Effected devices have been mitigated through an automatic update beyond the affected range.
Weakness: CWE-287
Which versions are affected by CVE-2023-2626?
It affects 5 products.
Products include Google Nest Hub Firmware, Google Nest Hub Max Firmware, Google Nest Wifi 6e Firmware, Google Nest Wifi Point Firmware, Google Wifi Firmware.
How do I fix CVE-2023-2626?
No fix has been published for CVE-2023-2626 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-2626 being exploited?
There is no known exploitation of CVE-2023-2626 in the wild and no public exploit code.