Technical impact
Based on the description, it is inferred that the attacker must be authenticated on the same Thread network in order to send malicious MLE packets. OpenThread, the Thread networking stack used by Google Nest devices, contains several vulnerabilities in the processing of MLE packets. An attacker that is authenticated on the same Thread network can construct and transmit specially crafted packets that trigger assertion failures or cause a stack-based buffer overflow. These weaknesses can crash the firmware running on the Nest device, leading to an interruption of service and loss of device availability.
Affected Systems
Google Nest devices that incorporate OpenThread for Thread network communication are affected. The specific firmware or product versions are not enumerated in the available data, so any Nest device that relies on the vulnerable OpenThread code could be impacted.
Risk and Exploitability
Based on the description, it is inferred that the attacker would need authenticated access to the Thread network to exploit the flaw. The CVSS score is 10, indicating critical severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated presence on the same Thread network, so an attacker would need to compromise a device within the local network or be a legitimate participant in the Thread network. Once authenticated, the attacker can send malicious MLE packets; as the OpenThread implementation fails to validate input safely, the crafted packets trigger either an assertion failure or a buffer overflow, causing the Nest device to crash and thus deny service.
