Read the docs
TI-2023-02455 Aliases CVE-2023-2626

Authentication Bypass in OpenThread Boarder Router devices

Priority LOW 39CWE-287Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

There exists an authentication bypass vulnerability in OpenThread border router devices and implementations. This issue allows unauthenticated nodes to craft radio frames using “Key ID Mode 2”: a special mode using a static encryption key to bypass security checks, resulting in arbitrary IP packets being allowed on the Thread network. This provides a pathway for an attacker to send/receive arbitrary IPv6 packets to devices on the LAN, potentially exploiting them if they lack additional authentication or contain any network vulnerabilities that would normally be mitigated by the home router’s NAT firewall. Effected devices have been mitigated through an automatic update beyond the affected range.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00115 1st percentileScored 2026-11-07
Fix Fixed Nest Hub Max (Google): 10.20221207.2.120Nest Hub (2nd. gen) w/ Sleep Tracking (Google): 10.20221207.2.100042+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GoogleNest Hub Max10.20221207.2.109 to before 10.20221207.2.12010.20221207.2.120Patch availableCNA
GoogleNest Hub (2nd. gen) w/ Sleep Tracking10.20221207.2.100038 to before 10.20221207.2.10004210.20221207.2.100042Patch availableCNA
GoogleNest Wifi 6E1.59 to before 1.63.3559991.63.355999Patch availableCNA
GoogleGoogle Wifi (next gen)14150.881.7 to before 14150.882.914150.882.9Patch availableCNA
GoogleNest Wifi Point1.56.1 to before 1.56.3686711.56.368671Patch availableCNA
GoogleNest Hub Max10.20221207.2.109 to before 10.20221207.2.12010.20221207.2.120Patch availableCNA
GoogleNest Hub (2nd. gen) w/ Sleep Tracking10.20221207.2.100038 to before 10.20221207.2.10004210.20221207.2.100042Patch availableCNA
  • Nest Hub Max VendorGoogle Affected 10.20221207.2.109 to before 10.20221207.2.120 Fixed in 10.20221207.2.120 Patch available CNA
  • Nest Hub (2nd. gen) w/ Sleep Tracking VendorGoogle Affected 10.20221207.2.100038 to before 10.20221207.2.100042 Fixed in 10.20221207.2.100042 Patch available CNA
  • Nest Wifi 6E VendorGoogle Affected 1.59 to before 1.63.355999 Fixed in 1.63.355999 Patch available CNA
  • Google Wifi (next gen) VendorGoogle Affected 14150.881.7 to before 14150.882.9 Fixed in 14150.882.9 Patch available CNA
  • Nest Wifi Point VendorGoogle Affected 1.56.1 to before 1.56.368671 Fixed in 1.56.368671 Patch available CNA
  • Nest Hub Max VendorGoogle Affected 10.20221207.2.109 to before 10.20221207.2.120 Fixed in 10.20221207.2.120 Patch available CNA
  • Nest Hub (2nd. gen) w/ Sleep Tracking VendorGoogle Affected 10.20221207.2.100038 to before 10.20221207.2.100042 Fixed in 10.20221207.2.100042 Patch available CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:o:google:nest_hub_max_firmware:*:*:*:*:*:*:*:*10.20221207.2.109 to before 10.20221207.2.120VulnerableGoogle
cpe:2.3:h:google:nest_hub_max:-:*:*:*:*:*:*:*not specified by NVDRunning onGoogle
cpe:2.3:o:google:nest_hub_firmware:*:*:*:*:*:*:*:*10.20221207.2.100038 to before 10.20221207.2.100042VulnerableGoogle
cpe:2.3:h:google:nest_hub:-:*:*:*:*:*:*:*not specified by NVDRunning onGoogle
cpe:2.3:o:google:wifi_firmware:*:*:*:*:*:*:*:*14150.881.7 to before 14150.882.9VulnerableGoogle
cpe:2.3:h:google:wifi:-:*:*:*:*:*:*:*not specified by NVDRunning onGoogle
cpe:2.3:o:google:nest_wifi_point_firmware:*:*:*:*:*:*:*:*1.56.1 to before 1.56.368671VulnerableGoogle
cpe:2.3:h:google:nest_wifi_point:-:*:*:*:*:*:*:*not specified by NVDRunning onGoogle
cpe:2.3:o:google:nest_wifi_6e_firmware:*:*:*:*:*:*:*:*1.59 to before 1.63.355999VulnerableGoogle
cpe:2.3:h:google:nest_wifi_6e:-:*:*:*:*:*:*:*not specified by NVDRunning onGoogle
  • cpe:2.3:o:google:nest_hub_max_firmware:*:*:*:*:*:*:*:* Versions 10.20221207.2.109 to before 10.20221207.2.120 Vulnerable ·Google
  • cpe:2.3:h:google:nest_hub_max:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Google
  • cpe:2.3:o:google:nest_hub_firmware:*:*:*:*:*:*:*:* Versions 10.20221207.2.100038 to before 10.20221207.2.100042 Vulnerable ·Google
  • cpe:2.3:h:google:nest_hub:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Google
  • cpe:2.3:o:google:wifi_firmware:*:*:*:*:*:*:*:* Versions 14150.881.7 to before 14150.882.9 Vulnerable ·Google
  • cpe:2.3:h:google:wifi:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Google
  • cpe:2.3:o:google:nest_wifi_point_firmware:*:*:*:*:*:*:*:* Versions 1.56.1 to before 1.56.368671 Vulnerable ·Google
  • cpe:2.3:h:google:nest_wifi_point:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Google
  • cpe:2.3:o:google:nest_wifi_6e_firmware:*:*:*:*:*:*:*:* Versions 1.59 to before 1.63.355999 Vulnerable ·Google
  • cpe:2.3:h:google:nest_wifi_6e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Google

Remediation

  • Fix · CNA Nest Hub Max (Google) Fixed in 10.20221207.2.120
  • Fix · CNA Nest Hub (2nd. gen) w/ Sleep Tracking (Google) Fixed in 10.20221207.2.100042
  • Fix · CNA Nest Wifi 6E (Google) Fixed in 1.63.355999
  • Fix · CNA Google Wifi (next gen) (Google) Fixed in 14150.882.9
  • Fix · CNA Nest Wifi Point (Google) Fixed in 1.56.368671
  • Fix · CNA Nest Hub Max (Google) Fixed in 10.20221207.2.120
  • Fix · CNA Nest Hub (2nd. gen) w/ Sleep Tracking (Google) Fixed in 10.20221207.2.100042

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-2626

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences