Advisories · Technology
meshtastic firmware.
Every CVE that names meshtastic firmware among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failure
- meshtastic firmware
- CWE-20
- CVSS 10.0 CriticalCritical · CVSS 9+
Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow
- meshtastic firmware
- Code injection
- CWE-829
- CVSS 8.2 High
In Meshtastic, an attacker can spoof licensed amateur flag for a node
- meshtastic firmware
- CWE-348
- CVSS 5.3 Medium
Meshtastic firmware allows forged DMs with no PKC to show up as encrypted
- meshtastic firmware
- CWE-1287
- CVSS 9.4 CriticalCritical · CVSS 9+
Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDB
- meshtastic firmware
- Authentication bypass
- CVSS 2.7 Low
Traceroute_APP responses are not rate-limited.
- meshtastic firmware
- CWE-799
- CVSS 4.1 Medium
Meshtastic allows Command Injection in GitHub Action
- meshtastic firmware
- Command injection
- CVSS 4.3 Medium
Meshtastic crashes via an unimplemented routing module reply
- meshtastic firmware
- Denial of service
- CVSS 9.5 CriticalCritical · CVSS 9+
Meshtastic Repeated Public and Private Keypairs
- meshtastic firmware
- CWE-331
- CVSS 9.4 CriticalCritical · CVSS 9+
Meshtastic incorrectly hands malformed packets leads to controlled buffer overflow
- meshtastic firmware
- Memory corruption
- CVSS 5.3 Medium
Forged packets over MQTT can show up in direct messages in Meshtastic firmware
- meshtastic firmware
- Information disclosure
- CVSS 5.3 Medium
Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmware
- meshtastic firmware
- CWE-138
- CWE-159
- CVSS 6.4 Medium
Unauthorized usage of remote hardware module because of missing channel verification
- meshtastic firmware
- CWE-345
- CVSS 8.1 High
Meshtastic firmware Authentication/Authorization Bypass via MQTT
- meshtastic firmware
- Authentication bypass
- Broken access control
- CVSS 7.5 High
Device crash via malformed MQTT packet when downlink is enabled in Meshtastic device firmware
- meshtastic firmware
- CWE-755