Technical impact
The vulnerability is an improper input validation flaw in the NAT64 translator component of OpenThread. It allows an attacker on an adjacent IPv4 network to send specially crafted packets that cause the translator to generate corrupted IPv6 frames or to skip built‑in security checks. As a result, an attacker could introduce malformed traffic into the Thread mesh or potentially gain unauthorized influence over mesh communications.
Affected Systems
Affected product is OpenThread by The OpenThread Authors, on all platforms, for any release prior to commit 26a882d. This includes both Windows and Linux builds that bundle the NAT64 translator component. No specific vendor version strings are listed; the issue exists in all pre‑commit 26a882d releases.
Risk and Exploitability
The CVSS score of 6.0 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely local, requiring an attacker to have connectivity to the same IPv4 subnet as the NAT64 translator. Exploitation therefore requires either privilege within that local network or the ability to inject arbitrary IPv4 packets with options. No public exploits are currently reported, but the flaw could facilitate denial‑of‑service or serve as a stepping stone for further compromise within the Thread mesh.
