CVE-2026-19741: auth in zephyrproject zephyr

Zephyr's OpenThread integration defined a default PSKd "J01NME" used for Thread commissioning authentication. If a firmware image was built with CONFIG_OPENTHREAD_JOINER_AUTOSTART=y and the PSKd was not overridden, the device shipped with this publicly known credential. An attacker within 802.15.4 radio range could use any Thread commissioner registered with "J01NME" to complete the DTLS-PSK handshake, supply a malicious operational dataset, and take control of the device's Thread network connection. This allows the attacker to intercept, drop, inject, and spoof IPv6 traffic, effectively isolating the device from its intended network. The vulnerability only affects builds enabling joiner autostart with the default PSKd left unchanged, which is not the default configuration and not used in in-tree samples. The fix removes the default PSKd and adds a build assertion to require a unique PSKd when autostart is enabled, encouraging per-device provisioning of PSKd and manual start of the joiner.

An unauthenticated attacker within radio range can impersonate a Thread commissioner using the default PSKd and provision the device with a malicious operational dataset. This compromises the device's network integrity, allowing the attacker to control its Thread network participation, intercept and manipulate IPv6 traffic, and isolate the device from its intended network. Application-layer security with independent credentials remains unaffected. The exposure is limited to devices built with joiner autostart enabled and the default PSKd unchanged.

A fix is available that removes the default PSKd and adds a build-time assertion requiring a unique PSKd when joiner autostart is enabled. Products should provision a unique per-device PSKd from factory data and avoid relying on the default credential. Additionally, applications should start the joiner manually rather than relying on autostart. Users should upgrade to Zephyr version 4.5.0 or later where this fix is included.