Meshtastic vulnerabilities

Products

• Firmware 15
• Firmware 14

Newest

• meshtastic firmware Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failure CVE-2026-42566 7.5 HighJuly 19, 2026
• meshtastic firmware Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow CVE-2026-44359 10.0 CriticalJuly 19, 2026
• meshtastic firmware In Meshtastic, an attacker can spoof licensed amateur flag for a node CVE-2025-55292 8.2 HighJanuary 27, 2026
• meshtastic firmware Meshtastic firmware allows forged DMs with no PKC to show up as encrypted CVE-2025-53627 5.3 MediumDecember 29, 2025
• meshtastic firmware Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDB CVE-2025-55293 9.4 CriticalAugust 18, 2025
• meshtastic firmware Traceroute_APP responses are not rate-limited. CVE-2024-47065 2.7 LowJuly 11, 2025
• meshtastic firmware Meshtastic allows Command Injection in GitHub Action CVE-2025-53637 4.1 MediumJuly 10, 2025
• meshtastic firmware Meshtastic crashes via an unimplemented routing module reply CVE-2025-24798 4.3 MediumJuly 10, 2025
• meshtastic meshtastic-android Meshtastic-Android vulnerable to forged DMs with no PKC showing up as encrypted CVE-2025-52883 5.3 MediumJune 24, 2025
• meshtastic firmware Meshtastic Repeated Public and Private Keypairs CVE-2025-52464 Public exploit 9.5 CriticalJune 19, 2025
• meshtastic firmware Meshtastic incorrectly hands malformed packets leads to controlled buffer overflow CVE-2025-24797 Public exploit 9.4 CriticalApril 14, 2025
• meshtastic firmware Forged packets over MQTT can show up in direct messages in Meshtastic firmware CVE-2025-21608 5.3 MediumFebruary 18, 2025
• meshtastic firmware Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmware CVE-2024-51500 5.3 MediumNovember 4, 2024
• meshtastic firmware Unauthorized usage of remote hardware module because of missing channel verification CVE-2024-47079 6.4 MediumOctober 7, 2024
• meshtastic firmware Meshtastic firmware Authentication/Authorization Bypass via MQTT CVE-2024-47078 8.1 HighSeptember 25, 2024
• meshtastic firmware Device crash via malformed MQTT packet when downlink is enabled in Meshtastic device firmware CVE-2024-45038 7.5 HighAugust 27, 2024