PT-2025-53743 · Sdk+2 · Sdk+3

0Wulf + 1 · Publicado 2025-12-29 · Atualizado 2026-02-26 · CVE-2025-53627

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Meshtastic versions 2.5 through 2.7.14

Description Meshtastic firmware, starting with version 2.5, implemented asymmetric encryption (PKI) for direct messages. However, when the pki encrypted flag is absent, the firmware reverts to legacy AES-256-CTR channel encryption without notifying the user. This creates a potential downgrade attack where an adversary with knowledge of a shared channel key can inject spoofed direct messages that appear as if they are PKI encrypted. User applications, including the Web app, iOS/Android app, and SDK-based applications, lack the ability to distinguish between PKI-encrypted and legacy-encrypted direct messages, undermining the security benefits of the PKI implementation. The pki encrypted flag is a parameter used to indicate whether a direct message has been encrypted with PKI.

Recommendations Update to version 2.7.15 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-1287

Identificadores relacionados

CVE-2025-53627

GHSA-377P-PRWP-4HWF

Produtos afetados

Meshtastic

Sdk

Webapp

Ios/Android App

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53627.json · Exploit
• https://github.com/meshtastic/firmware/security/advisories/GHSA-377p-prwp-4hwf · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2025-53627 · Aviso do Fabricante
• https://t.me/CVEtracker/40847 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2005762367624265924 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-53627 · Nota de Segurança
• https://twitter.com/CVEnew/status/2005682610157068473 · Publicação no Twitter
• https://t.me/cveNotify/153363 · Publicação no Telegram