Skip to content
Meshtastic Firmware vulnerabilities
-
meshtastic firmware
Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failure
CVE-2026-42566
7.5 High
-
meshtastic firmware
Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow
CVE-2026-44359
10.0 Critical
-
meshtastic firmware
In Meshtastic, an attacker can spoof licensed amateur flag for a node
CVE-2025-55292
8.2 High
-
meshtastic firmware
Meshtastic firmware allows forged DMs with no PKC to show up as encrypted
CVE-2025-53627
5.3 Medium
-
meshtastic firmware
Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDB
CVE-2025-55293
9.4 Critical
-
meshtastic firmware
Traceroute_APP responses are not rate-limited.
CVE-2024-47065
2.7 Low
-
meshtastic firmware
Meshtastic allows Command Injection in GitHub Action
CVE-2025-53637
4.1 Medium
-
meshtastic firmware
Meshtastic crashes via an unimplemented routing module reply
CVE-2025-24798
4.3 Medium
-
meshtastic firmware
Meshtastic Repeated Public and Private Keypairs
CVE-2025-52464
Public exploit
9.5 Critical
-
meshtastic firmware
Meshtastic incorrectly hands malformed packets leads to controlled buffer overflow
CVE-2025-24797
Public exploit
9.4 Critical
-
meshtastic firmware
Forged packets over MQTT can show up in direct messages in Meshtastic firmware
CVE-2025-21608
5.3 Medium
-
meshtastic firmware
Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmware
CVE-2024-51500
5.3 Medium
-
meshtastic firmware
Unauthorized usage of remote hardware module because of missing channel verification
CVE-2024-47079
6.4 Medium
-
meshtastic firmware
Meshtastic firmware Authentication/Authorization Bypass via MQTT
CVE-2024-47078
8.1 High
-
meshtastic firmware
Device crash via malformed MQTT packet when downlink is enabled in Meshtastic device firmware
CVE-2024-45038
7.5 High