CVE-2025-24797

CVE-2025-24797 concerns Meshtastic, an open-source mesh networking solution. A fault in handling mesh packets containing invalid protobuf data can cause an attacker-controlled buffer overflow, hijacking execution flow and potentially enabling remote code execution. The root cause, as described in...

CVE-2024-45038

Summary (CVE-2024-45038) : The vulnerability is a denial-of-service in the MQTT handling of the Meshtastic device firmware prior to version 2.4.1. The fix is in Meshtastic firmware version 2.4.1 and on the Meshtastic public MQTT Broker. Affected product: Meshtastic device firmware (pre-2.4.1). Im...

CVE-2024-51500

The CVE-2024-51500 entry affects Meshtastic firmware. Description details that the firmware does not inspect packets from the special broadcast address 0xFFFFFFFF, enabling a malicious actor to craft a broadcast-like packet that amplifies a single message into multiple messages across every node,...

CVE-2024-47079

The CVE-2024-47079 entry concerns Meshtastic firmware where the remote hardware module failed to validate incoming remote hardware control messages. Root cause: the validation checks were missing, allowing unauthorized usage of the remote hardware module. Impact: as described, potential improper ...

CVE-2024-47078

Meshtastic firmware prior to 2.5.1 contains weaknesses in the MQTT implementation that bypass authentication and authorization, allowing unauthorized control of MQTT-connected nodes. Version 2.5.1 patches the issue. Practical impact: unauthorized access/control via MQTT. Remediation: upgrade to 2...

CVE-2025-55293

Meshtastic (vulnerable before 2.6.3) allows crafting NodeInfo packets to overwrite a known node’s publicKey in NodeDB. Attack flow: first send NodeInfo with an empty publicKey to bypass size checks (clears existing key), then send a new key that gets stored. Root cause is improper handling of emp...

CVE-2024-47065

CVE-2024-47065 affects Meshtastic before version 2.5.1, where traceroute responses from remote nodes were not rate limited. This allows rapid, repeated responses (approximately 100 samples in ~2 minutes) and can enable a 2:1 reflected DoS, with positional confidentiality concerns highlighted as a...

CVE-2025-55292

CVE-2025-55292 affects Meshtastic, where NodeIDs are derived from MAC addresses instead of public keys, enabling an attacker to forge a NodeInfo and advertise HAM mode (which lacks encryption). This allows other mesh nodes to accept the forged information, overwrite the NodeDB, and route direct m...

CVE-2025-53637

Summary: CVE-2025-53637 affects Meshtastic open-source firmware; the issue resides in the main_matrix.yml GitHub Action, where user input is interpolated unsafely in shell code. This can be triggered by a attacker who forks the repository and opens a pull request via pull_request_target, leveragi...