CVE-2025-24798

Meshtastic is an open source mesh networking solution. From 1.2.1 until 2.6.2, a packet sent to the routing module that contains wantresponse==true causes a crash. This can lead to a degradation of service for nodes within range of a malicious sender, or via MQTT if downlink is enabled. This...

CVE-2025-53637

Meshtastic is an open source mesh networking solution. The mainmatrix.yml GitHub Action is triggered by the pullrequesttarget event, which has extensive permissions, and can be initiated by an attacker who forked the repository and created a pull request. In the shell code execution part,...

CVE-2025-53637 Meshtastic allows Command Injection in GitHub Action

Meshtastic is an open source mesh networking solution. The mainmatrix.yml GitHub Action is triggered by the pullrequesttarget event, which has extensive permissions, and can be initiated by an attacker who forked the repository and created a pull request. In the shell code execution part,...

CVE-2025-53637

Summary: CVE-2025-53637 affects Meshtastic open-source firmware; the issue resides in the main_matrix.yml GitHub Action, where user input is interpolated unsafely in shell code. This can be triggered by a attacker who forks the repository and opens a pull request via pull_request_target, leveragi...

CVE-2025-24798 Meshtastic crashes via an unimplemented routing module reply

Meshtastic is an open source mesh networking solution. From 1.2.1 until 2.6.2, a packet sent to the routing module that contains wantresponse==true causes a crash. This can lead to a degradation of service for nodes within range of a malicious sender, or via MQTT if downlink is enabled. This...

CVE-2025-24798

CVE-2025-24798 – Meshtastic : Affects Meshtastic Open Source firmware versions 1.2.1 through 2.6.2. A crafted packet sent to the routing module with want_response==true can crash the router, causing degradation of service for nodes within range and potentially affecting MQTT downlinks. Root cause...

CVE-2025-24798 Meshtastic crashes via an unimplemented routing module reply

Meshtastic is an open source mesh networking solution. From 1.2.1 until 2.6.2, a packet sent to the routing module that contains wantresponse==true causes a crash. This can lead to a degradation of service for nodes within range of a malicious sender, or via MQTT if downlink is enabled. This...

CVE-2025-24798 Meshtastic crashes via an unimplemented routing module reply

Meshtastic is an open source mesh networking solution. From 1.2.1 until 2.6.2, a packet sent to the routing module that contains wantresponse==true causes a crash. This can lead to a degradation of service for nodes within range of a malicious sender, or via MQTT if downlink is enabled. This...

PT-2025-29170 · Unknown · Meshtastic

Name of the Vulnerable Software and Affected Versions: Meshtastic versions prior to 2.6.6 Description: Meshtastic is an open source mesh networking solution. The main matrix.yml GitHub Action is triggered by the pull request target event, which has extensive permissions and can be initiated by an...

PT-2025-29169 · Unknown · Meshtastic

Name of the Vulnerable Software and Affected Versions: Meshtastic versions 1.2.1 through 2.6.2 Description: Meshtastic is an open source mesh networking solution. A packet sent to the routing module with want response set to true causes a crash. This can lead to a degradation of service for nodes...

Meshtastic device firmware 操作系统命令注入漏洞

Meshtastic device firmware is a Meshtastic open source firmware for Meshtastic devices running open source, off-grid, decentralized mesh networks. An operating system command injection vulnerability exists in Meshtastic device firmware versions prior to 2.6.6, which stems from insecure insertion ...

Meshtastic device firmware 安全漏洞

Meshtastic device firmware is a Meshtastic open source firmware for Meshtastic devices running open source, off-grid, decentralized mesh networks. A security vulnerability exists in Meshtastic device firmware version 1.2.1 through versions prior to 2.6.2, which stems from a possible crash when th...

CVE-2025-52883

Meshtastic-Android is an Android application for the mesh radio software Meshtastic. Prior to version 2.5.21, an attacker is able to send an unencrypted direct message to a victim impersonating any other node of the mesh. This message will be displayed in the same chat that the victim normally...

CVE-2025-52883

Meshtastic-Android is an Android application for the mesh radio software Meshtastic. Prior to version 2.5.21, an attacker is able to send an unencrypted direct message to a victim impersonating any other node of the mesh. This message will be displayed in the same chat that the victim normally...

CVE-2025-52883 Meshtastic-Android vulnerable to forged DMs with no PKC showing up as encrypted

Meshtastic-Android is an Android application for the mesh radio software Meshtastic. Prior to version 2.5.21, an attacker is able to send an unencrypted direct message to a victim impersonating any other node of the mesh. This message will be displayed in the same chat that the victim normally...

CVE-2025-52883 Meshtastic-Android vulnerable to forged DMs with no PKC showing up as encrypted

Meshtastic-Android is an Android application for the mesh radio software Meshtastic. Prior to version 2.5.21, an attacker is able to send an unencrypted direct message to a victim impersonating any other node of the mesh. This message will be displayed in the same chat that the victim normally...

CVE-2025-52883 Meshtastic-Android vulnerable to forged DMs with no PKC showing up as encrypted

Meshtastic-Android is an Android application for the mesh radio software Meshtastic. Prior to version 2.5.21, an attacker is able to send an unencrypted direct message to a victim impersonating any other node of the mesh. This message will be displayed in the same chat that the victim normally...

The vulnerability of the rweather library and the crypto-based solutions for organizing tactical radio communications in hard-to-access areas like Meshtastic allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the rweather library and the crypto-based solutions for organizing tactical radio communications in hard-to-access areas like Meshtastic is related to insufficient entropy during key generation. Exploiting this vulnerability allows a remote attacker to compromise the...

Meshtastic-Android 安全漏洞

Meshtastic-Android is an Android application from the Meshtastic open source. A security vulnerability exists in Meshtastic-Android versions prior to 2.5.21, which stems from the fact that an attacker can send an unencrypted direct message to impersonate another node, potentially leading to a fal...

PT-2025-26783 · Unknown · Meshtastic-Android

Name of the Vulnerable Software and Affected Versions: Meshtastic-Android versions prior to 2.5.21 Description: The issue allows an attacker to send an unencrypted direct message to a victim, impersonating any other node of the mesh. This message will be displayed in the same chat that the victim...