CVE-2023-2626
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedThere exists an authentication bypass vulnerability in OpenThread border router devices and implementations. This issue allows unauthenticated nodes to craft radio frames using “Key ID Mode 2”: a special mode using a static encryption key to bypass security checks, resulting in arbitrary IP packets being allowed on the Thread network. This provides a pathway for an attacker to send/receive arbitrary IPv6 packets to devices on the LAN, potentially exploiting them if they lack additional authentication or contain any network vulnerabilities that would normally be mitigated by the home router’s NAT firewall. Effected devices have been mitigated through an automatic update beyond the affected range.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceThis is an authentication bypass vulnerability in OpenThread border routers where the 'Key ID Mode 2' uses a static encryption key that can be crafted by unauthenticated attackers to bypass security checks. This allows arbitrary IPv6 packets to be injected into the Thread network, potentially reaching devices on the LAN that would normally be protected by NAT firewalls.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data>= 10.20221207.2.109, < 10.20221207.2.120>= 10.20221207.2.100038, < 10.20221207.2.100042>= 14150.881.7, < 14150.882.9>= 1.56.1, < 1.56.368671>= 1.59, < 1.63.355999CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Adjacent
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify the device typeDetermine if the device is a Google Nest Hub Max, Google Nest Hub, Google Wifi, Google Nest Wifi Point, or Google Nest Wifi 6e border routerAffected if The device is not one of these Google Thread border router models, the vulnerability does not apply
-
Check the firmware versionAccess the device admin interface or use the manufacturer's app to view the current firmware versionAffected if The installed firmware version falls within one of the affected ranges: Nest Hub Max >= 10.20221207.2.109 and < 10.20221207.2.120; Nest Hub >= 10.20221207.2.100038 and < 10.20221207.2.100042; Google Wifi >= 14150.881.7 and < 14150.882.9; Nest Wifi Point >= 1.56.1 and < 1.56.368671; Nest Wifi 6e >= 1
-
Verify Thread border router is enabledCheck the device settings to confirm that Thread networking or border router functionality is activeAffected if Thread border router is not enabled, the attack surface is not present
-
Check Key ID Mode configurationInspect the Thread network security settings for the Key ID mode in use. If Key ID Mode 2 is configured, the device uses the vulnerable static key methodAffected if Key ID Mode 2 is in use, the device is vulnerable to authentication bypass
A user is affected if they have a Google Nest/Google Wifi Thread border router with firmware within the affected version range AND Thread border router functionality is enabled AND Key ID Mode 2 is in use.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped1.56.3686711.63.35599910.20221207.2.120
Apply the automatic firmware/software update provided by device manufacturers to obtain a version beyond the affected range. Organizations should inventory all Thread border router devices to ensure complete coverage.
Nest Hub Max: 10.20221207.2.120+ | Nest Hub: 10.20221207.2.100042+ | Wifi: 14150.882.9+ | Nest Wifi Point: 1.56.368671+ | Nest Wifi 6e: 1.63.355999+
- 1. Verify current firmware version on the affected device by navigating to the Google Home app, selecting the device, and checking the device info or settings.
- 2. Ensure automatic updates are enabled on the device: Go to device settings in the Google Home app and verify 'Automatic updates' is turned ON.
- 3. If the device shows an affected firmware version (Nest Hub Max < 10.20221207.2.120, Nest Hub < 10.20221207.2.100042, Nest Wifi < 14150.882.9, Nest Wifi Point < 1.56.368671, Nest Wifi 6e < 1.63.355999), trigger a manual update check if available or wait for the automatic update which has already been deployed.
- 4. After updating, verify the firmware has been upgraded to a version beyond the affected range (10.20221207.2.120 or higher for Nest Hub Max, etc.).
- 5. For additional network segmentation, ensure the Thread border router is placed behind a NAT firewall and internal devices implement their own authentication to limit exposure from this vulnerability.
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation4.0 h
- Implementation6.0 h
- Testing3.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,304.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2023-2626 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2023-2626 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data