Zephyr's OpenThread integration defines a default Joining Device Credential (PSKd) that is publicly documented. A firmware image compiled with CONFIG_OPENTHREAD_JOINER_AUTOSTART enabled and no explicit PSKd compiled into the binary therefore ships with the known credential J01NME. An attacker within 802.15.4 radio range can act as a Thread commissioner, perform a DTLS‑PSK handshake, and provision the device with an attacker‑controlled operational dataset. The compromised device then joins the attacker’s mesh, exposing all of its IPv6 traffic and allowing the attacker to impersonate peers and disrupt the device’s intended network.

Zephyr RTOS systems that enable OpenThread joiner autostart without configuring a unique PSKd. This includes any build of Zephyr whose configuration includes CONFIG_OPENTHREAD_JOINER_AUTOSTART and leaves CONFIG_OPENTHREAD_JOINER_PSKD set to the default value J01NME. The vulnerability is present regardless of the specific Zephyr version, but is limited to builds that enable the vulnerable combination of settings. No specific product release is listed; all affected products fall under the zephyrproject:zephyr vendor.

The vulnerability has a CVSS score of 7.5, indicating a high severity. The EPSS score is not available, but the lack of a KEV listing does not diminish the risk for production devices that ship with the default credential. Exploitation requires the attacker to have physical or near‑physical proximity to the victim device within 802.15.4 range, and the device must be factory fresh or reset so that it has no stored operational dataset. Once those conditions are met, an unauthenticated attacker can complete the DTLS‑PSK handshake with the known credential, obtain commissioning rights, and supply a malicious operational dataset. The attacker then controls the device’s Thread network participation, with the ability to intercept, drop, inject, and spoof traffic. This represents a significant loss of confidentiality, integrity, and availability for any application running on the compromised device.