Vulnerability · Published Feb 18, 2025 · Assigned by GitHub_M
CVE-2025-21608Forged packets over MQTT can show up in direct messages in Meshtastic firmware
Medium 5.3
In plain English
A medium-severity security flaw in firmware from meshtastic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 4.0)5.3Medium
Exploit odds (30 days)0.4%top 68.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Meshtastic is an open source mesh networking solution. In affected firmware versions crafted packets over MQTT are able to appear as a DM in client to a node even though they were not decoded with PKC. This issue has been addressed in version 2.5.19 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| meshtastic | firmware | >= 2.5.0, <= 2.5.18 |
Weakness: CWE-668 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/meshtastic/firmware/security/advisories/GHSA-c967-qc39-3hf5 x_refsource_CONFIRM