meshyface

Meshyface Meshyface は、単一の Python サービスとして動作し、HTTP 経由でシングルページの Web UI を提供する、チャットファーストの Meshtastic ダッシュボードです。 現在のアプリケーション領域 現在の UI は以下を提供します: チャットおよびダイレクトピア会話 ネットワークワークスペース（マップ、概要、リンク、ルート、センサー、トップ10ランキング、ノード詳細、オンデマンド履歴） コンソールワークスペース（ライブパケット/ログ出力） アプリワークスペース（ゲームと、ファイル転送が有効な場合のファイルタブ）...

CVE-2025-24797

CVE-2025-24797 CVE-2025-24797 상세 - NVD 요약 잘못된 protobuf 데이터를 포함한 메시 패킷 처리의 결함으로 인해 공격자가 제어하는 버퍼 오버플로우가 발생할 수 있으며, 이로 인해 공격자가 실행 흐름을 탈취하여 잠재적으로 원격 코드 실행이 가능할 수 있습니다. 이 공격은 대상 장치가 기본 채널에서 패킷을 재브로드캐스트하는 한 인증이나 사용자 상호작용이 필요하지 않습니다. 근본 원인 이 취약점은 처음에 퍼징을 통해 발견되었으며, 다음과 같은 ASAN 중단이 발생했습니다: DEBUG | 22:27:...

meshtastic-cve-2025-52464-poc

Meshtastic CVE-2025-52464 概念実証 概要 このプロジェクトは、Meshtastic ファームウェア バージョン 2.5.0 から 2.6.10 に影響を与える脆弱性 CVE-2025-52464 を実証する、ソフトウェアのみの概念実証です。 この実装は、脆弱なファームウェアの暗号動作を再現し、重複した鍵や低エントロピーの暗号鍵によって攻撃者が暗号化されたダイレクトメッセージ（DM）を復号できる仕組みを示します。また、ファームウェア バージョン 2.6.11...

CVE-2026-43980

Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names longname, shortname received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtast...

EUVD-2026-64171

Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names longname, shortname received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtast...

CVE-2026-43980

Malla , a web analyzer for Meshtastic networks based on MQTT data, is affected by a stored XSS vulnerability. Node names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping across multiple frontend pages (traceroute_graph....

CVE-2026-43980 Malla: Stored XSS via Meshtastic node names in multiple frontend pages

Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names longname, shortname received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtast...

CVE-2026-43980 Malla: Stored XSS via Meshtastic node names in multiple frontend pages

Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names longname, shortname received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtast...

CVE-2026-43980 Malla: Stored XSS via Meshtastic node names in multiple frontend pages

Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names longname, shortname received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtast...

UBUNTU-CVE-2026-42566

Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.longname that contains a malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The malformed name does not need to be...

UBUNTU-CVE-2026-44359

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered by pullrequesttarget and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated...

Linux Distros Unpatched Vulnerability : CVE-2026-42566

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.longname that contains a malformed...

CVE-2026-42566: Improper Input Validation

Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.longname that contains a malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The malformed name does not need to be...

Linux Distros Unpatched Vulnerability : CVE-2026-44359

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered ...

CVE-2026-42566

Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.longname that contains a malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The malformed name does not need to be...

CVE-2026-44359

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered by pullrequesttarget and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated...

CVE-2026-44359: Improper Control of Generation of Code

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered by pullrequesttarget and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated...

CVE-2026-42566

Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.longname that contains a malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The malformed name does not need to be...

CVE-2026-42566

The CVE affects Meshtastic firmware prior to 2.7.23.b246bcd where a single node advertising a User.long_name containing malformed UTF-8 over LoRa can render other radios unusable over BLE when managed via the iOS app. Root cause: a null terminator can be placed in the middle of a multibyte sequen...

CVE-2026-42566 Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failure

Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.longname that contains a malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The malformed name does not need to be...