OpenThread Border Router (< B47613f1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/openthread-border-router--b47613f1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 25 Oct 2026 21:47:04 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOpenThread: mDNS discovery proxy denial of service (CVE-2026-112325)https://feed.craftedsignal.io/briefs/2026-10-openthread-mdns-dos/Sun, 25 Oct 2026 21:47:04 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-openthread-mdns-dos/A NULL-pointer dereference vulnerability in the OpenThread DNS-SD Discovery Proxy allows a remote attacker on the same Thread mesh to trigger a denial of service on the Border Router via two crafted DNS-SD queries.OpenThread's native Multicast DNS (mDNS) implementation contains a vulnerability in the Core::RecordCache::Matches() function. The function fails to validate that the mNextLabels pointer of an incoming DNS-SD querier is non-NULL before passing it to NameMatch(). An attacker on a Thread mesh can send two specific, well-formed DNS-SD query packets that cause the Matches() function to dereference a NULL pointer, crashing the OpenThread Border Router (OTBR). This results in a denial of service (DoS) for the entire Thread network, as the router loses its capability to facilitate off-network connectivity.

Attack Chain

  1. An attacker gains access to a device on the Thread mesh (e.g., a compromised IoT sensor or light bulb).
  2. The attacker sends a first DNS-SD query (QNAME: default.service.arpa.default.service.arpa) to the Border Router.
  3. The Border Router processes the query, resulting in a cache entry with a non-NULL mNextLabels value.
  4. The attacker sends a second DNS-SD query (QNAME: default.service.arpa).
  5. The StripDomainName() function fails to strip the domain, resulting in an incoming querier with mNextLabels = nullptr.
  6. The RecordCache::Matches() function executes, comparing the new query against the cached entry.
  7. The RecordCache::Matches() function enters the else branch, invoking NameMatch() without checking if the querier's mNextLabels is NULL.
  8. NameMatch() dereferences the NULL pointer (address 0x0), crashing the process.

Impact

The crash causes an immediate denial of service on the OpenThread Border Router. Because the Border Router acts as the gateway between the Thread mesh and external networks, the entire Thread network is cut off from off-network connectivity until the service or device is manually recovered.

Recommendation

  • Upgrade OpenThread and OpenThread Border Router (OTBR) to a revision containing commit b47613f1 or later.
  • Audit mesh networks for unauthorized devices, as the exploit requires adjacency to the Thread interface.
  • Implement monitoring for service crashes on Border Router hardware to identify potential exploitation attempts.
]]>mediumadvisorydenial-of-serviceiotopenthreadmdns