meshtastic records

14 published records for vendor meshtastic.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 57.1%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

14 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2025-24797Proof of concept	Meshtastic incorrectly hands malformed packets leads to controlled buffer overflowmeshtastic · meshtastic firmware · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	0.9%	Apr 14, 2025
39Monitor	CVE-2024-47078No exploit	Meshtastic firmware Authentication/Authorization Bypass via MQTTmeshtastic · meshtastic firmware · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.5%	Sep 25, 2024
39Monitor	CVE-2025-55293No exploit	Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDBmeshtastic · meshtastic firmware · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.4%	Aug 18, 2025
38Monitor	CVE-2025-52464Proof of concept	Meshtastic Repeated Public and Private Keypairsmeshtastic · meshtastic firmware · CWE-331 Pre-auth	Critical9.5	—	0.6%	Jun 19, 2025
32Monitor	CVE-2025-53637No exploit	Meshtastic allows Command Injection in GitHub Actionmeshtastic · meshtastic firmware · CWE-78 RCE Command injection	High8.0	—	0.3%	Jul 10, 2025
32Monitor	CVE-2025-55292No exploit	In Meshtastic, an attacker can spoof licensed amateur flag for a nodemeshtastic · meshtastic firmware · CWE-348 Pre-auth	High8.2	—	0.1%	Jan 27, 2026
30Monitor	CVE-2024-45038No exploit	Device crash via malformed MQTT packet when downlink is enabled in Meshtastic device firmwaremeshtastic · meshtastic firmware · CWE-755 Pre-auth Denial of service	High7.5	—	0.6%	Aug 27, 2024
30Monitor	CVE-2026-42566No exploit	Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failuremeshtastic · meshtastic firmware · CWE-20 Pre-auth Denial of service	High7.5	—	0.5%	Jul 19, 2026
30Monitor	CVE-2024-51500No exploit	Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmwaremeshtastic · meshtastic firmware · CWE-138 Pre-auth Denial of service	High7.5	—	0.4%	Nov 4, 2024
26Monitor	CVE-2025-24798No exploit	Meshtastic crashes via an unimplemented routing module replymeshtastic · meshtastic firmware · CWE-617 Pre-auth Denial of service	Medium6.5	—	0.4%	Jul 10, 2025
25Monitor	CVE-2024-47079No exploit	Unauthorized usage of remote hardware module because of missing channel verificationmeshtastic · meshtastic firmware · CWE-345 Pre-auth	Medium6.4	—	0.2%	Oct 7, 2024
21Monitor	CVE-2025-21608No exploit	Forged packets over MQTT can show up in direct messages in Meshtastic firmwaremeshtastic · meshtastic firmware · CWE-668 Pre-auth	Medium5.3	—	0.4%	Feb 18, 2025
21Monitor	CVE-2025-53627No exploit	Meshtastic firmware allows forged DMs with no PKC to show up as encryptedmeshtastic · meshtastic firmware · CWE-1287 Pre-auth	Medium5.3	—	0.2%	Dec 29, 2025
10Monitor	CVE-2024-47065No exploit	Traceroute_APP responses are not rate-limited.meshtastic · meshtastic firmware · CWE-799 Pre-auth	Low2.7	—	0.2%	Jul 11, 2025

CVE-2025-24797
39Monitor
Meshtastic incorrectly hands malformed packets leads to controlled buffer overflow
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
- Memory safety
meshtastic · meshtastic firmwareApr 14, 2025
CVE-2024-47078
39Monitor
Meshtastic firmware Authentication/Authorization Bypass via MQTT
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
meshtastic · meshtastic firmwareSep 25, 2024
CVE-2025-55293
39Monitor
Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDB
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
meshtastic · meshtastic firmwareAug 18, 2025
CVE-2025-52464
38Monitor
Meshtastic Repeated Public and Private Keypairs
CriticalCVSS 9.5Proof of conceptEPSS 1%
- Pre-auth
meshtastic · meshtastic firmwareJun 19, 2025
CVE-2025-53637
32Monitor
Meshtastic allows Command Injection in GitHub Action
HighCVSS 8.0No exploitEPSS 0%
- RCE
- Command injection
meshtastic · meshtastic firmwareJul 10, 2025
CVE-2025-55292
32Monitor
In Meshtastic, an attacker can spoof licensed amateur flag for a node
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
meshtastic · meshtastic firmwareJan 27, 2026
CVE-2024-45038
30Monitor
Device crash via malformed MQTT packet when downlink is enabled in Meshtastic device firmware
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Denial of service
meshtastic · meshtastic firmwareAug 27, 2024
CVE-2026-42566
30Monitor
Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failure
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
meshtastic · meshtastic firmwareJul 19, 2026
CVE-2024-51500
30Monitor
Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmware
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
meshtastic · meshtastic firmwareNov 4, 2024
CVE-2025-24798
26Monitor
Meshtastic crashes via an unimplemented routing module reply
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- Denial of service
meshtastic · meshtastic firmwareJul 10, 2025
CVE-2024-47079
25Monitor
Unauthorized usage of remote hardware module because of missing channel verification
MediumCVSS 6.4No exploitEPSS 0%
- Pre-auth
meshtastic · meshtastic firmwareOct 7, 2024
CVE-2025-21608
21Monitor
Forged packets over MQTT can show up in direct messages in Meshtastic firmware
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
meshtastic · meshtastic firmwareFeb 18, 2025
CVE-2025-53627
21Monitor
Meshtastic firmware allows forged DMs with no PKC to show up as encrypted
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
meshtastic · meshtastic firmwareDec 29, 2025
CVE-2024-47065
10Monitor
Traceroute_APP responses are not rate-limited.
LowCVSS 2.7No exploitEPSS 0%
- Pre-auth
meshtastic · meshtastic firmwareJul 11, 2025