{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/openthread-border-router--b47613f1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:openthread:openthread:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-112325"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenThread (\u003c b47613f1)","OpenThread Border Router (\u003c b47613f1)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","iot","openthread","mdns"],"_cs_type":"advisory","_cs_vendors":["OpenThread"],"content_html":"\u003cp\u003eOpenThread's native Multicast DNS (mDNS) implementation contains a vulnerability in the \u003ccode\u003eCore::RecordCache::Matches()\u003c/code\u003e function. The function fails to validate that the \u003ccode\u003emNextLabels\u003c/code\u003e pointer of an incoming DNS-SD querier is non-NULL before passing it to \u003ccode\u003eNameMatch()\u003c/code\u003e. An attacker on a Thread mesh can send two specific, well-formed DNS-SD query packets that cause the \u003ccode\u003eMatches()\u003c/code\u003e function to dereference a NULL pointer, crashing the OpenThread Border Router (OTBR). This results in a denial of service (DoS) for the entire Thread network, as the router loses its capability to facilitate off-network connectivity.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains access to a device on the Thread mesh (e.g., a compromised IoT sensor or light bulb).\u003c/li\u003e\n\u003cli\u003eThe attacker sends a first DNS-SD query (\u003ccode\u003eQNAME\u003c/code\u003e: \u003ccode\u003edefault.service.arpa.default.service.arpa\u003c/code\u003e) to the Border Router.\u003c/li\u003e\n\u003cli\u003eThe Border Router processes the query, resulting in a cache entry with a non-NULL \u003ccode\u003emNextLabels\u003c/code\u003e value.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a second DNS-SD query (\u003ccode\u003eQNAME\u003c/code\u003e: \u003ccode\u003edefault.service.arpa\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eStripDomainName()\u003c/code\u003e function fails to strip the domain, resulting in an incoming querier with \u003ccode\u003emNextLabels = nullptr\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eRecordCache::Matches()\u003c/code\u003e function executes, comparing the new query against the cached entry.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eRecordCache::Matches()\u003c/code\u003e function enters the \u003ccode\u003eelse\u003c/code\u003e branch, invoking \u003ccode\u003eNameMatch()\u003c/code\u003e without checking if the querier's \u003ccode\u003emNextLabels\u003c/code\u003e is NULL.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eNameMatch()\u003c/code\u003e dereferences the NULL pointer (address 0x0), crashing the process.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe crash causes an immediate denial of service on the OpenThread Border Router. Because the Border Router acts as the gateway between the Thread mesh and external networks, the entire Thread network is cut off from off-network connectivity until the service or device is manually recovered.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenThread and OpenThread Border Router (OTBR) to a revision containing commit \u003ccode\u003eb47613f1\u003c/code\u003e or later.\u003c/li\u003e\n\u003cli\u003eAudit mesh networks for unauthorized devices, as the exploit requires adjacency to the Thread interface.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for service crashes on Border Router hardware to identify potential exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-25T21:47:04Z","date_published":"2026-10-25T21:47:04Z","id":"https://feed.craftedsignal.io/briefs/2026-10-openthread-mdns-dos/","summary":"A NULL-pointer dereference vulnerability in the OpenThread DNS-SD Discovery Proxy allows a remote attacker on the same Thread mesh to trigger a denial of service on the Border Router via two crafted DNS-SD queries.","title":"OpenThread: mDNS discovery proxy denial of service (CVE-2026-112325)","url":"https://feed.craftedsignal.io/briefs/2026-10-openthread-mdns-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - OpenThread Border Router (\u003c B47613f1)","version":"https://jsonfeed.org/version/1.1"}