PT-2024-32394 · Unknown · Meshtastic

Zach3478 · Published 2024-09-25 · Updated 2024-12-02 · CVE-2024-47078

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Meshtastic versions prior to 2.5.1

Description Meshtastic is an open source, off-grid, decentralized, mesh network that uses MQTT to communicate over an internet connection to a shared or private MQTT Server. Nodes can communicate directly via an internet connection or proxied through a connected phone via bluetooth. Multiple weaknesses in the MQTT implementation allow for authentication and authorization bypasses, resulting in unauthorized control of MQTT-connected nodes.

Recommendations For versions prior to 2.5.1, update to version 2.5.1 to resolve the issue. As a temporary workaround, consider restricting access to the MQTT implementation until the patch is applied. Avoid using the vulnerable MQTT connection in the affected nodes until the issue is resolved.

Exploit

Fix

Incorrect Authorization

Improper Authentication

Weakness Enumeration

CWE-863

CWE-287

Related Identifiers

CVE-2024-47078

GHSA-VQCQ-WJWX-7252

Affected Products

Meshtastic

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47078.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-47078 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47078 · Security Note
• https://github.com/meshtastic/firmware/security/advisories/GHSA-vqcq-wjwx-7252 · Note
• https://github.com/meshtastic/firmware · Note
• https://t.me/cvenotify/102812 · Telegram Post
• https://t.me/cvenotify/96735 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1839038718780260552 · Twitter Post
• https://t.me/cvedetector/6331 · Telegram Post
• https://t.me/latest_high_impact_cve/1217 · Telegram Post
• https://twitter.com/CVEnew/status/1838966749208723556 · Twitter Post