Vulnerability · Published Aug 27, 2024 · Assigned by GitHub_M

CVE-2024-45038Device crash via malformed MQTT packet when downlink is enabled in Meshtastic device firmware

High 7.5

In plain English

A high-severity security flaw in firmware from meshtastic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 51.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Meshtastic device firmware is a firmware for meshtastic devices to run an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic device firmware is subject to a denial of serivce vulnerability in MQTT handling, fixed in version 2.4.1 of the Meshtastic firmware and on the Meshtastic public MQTT Broker. It's strongly suggested that all users of Meshtastic, particularly those that connect to a privately hosted MQTT server, update to this or a more recent stable version right away. There are no known workarounds for this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
meshtastic	firmware	< 2.4.1

Weakness: CWE-755 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/meshtastic/firmware/security/advisories/GHSA-3x3r-vw9f-pxq5 x_refsource_CONFIRM