PT-2024-34665 · Unknown · Meshtastic

Jeholliday · Published 2024-11-04 · Updated 2025-10-15 · CVE-2024-51500

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Meshtastic firmware versions prior to 2.5.6

Description The Meshtastic firmware does not check for packets claiming to be from the special broadcast address (0xFFFFFFFF), which could result in unexpected behavior and potential for DDoS attacks on the network. A malicious actor could craft a packet to be from that address, which would result in an amplification of this one message into every node on the network sending multiple messages. Such an attack could result in degraded network performance for all users as the available bandwidth is consumed.

Recommendations For Meshtastic firmware versions prior to 2.5.6, upgrade to release version 2.5.6 to address the issue. As a temporary workaround, consider restricting network traffic to minimize the risk of exploitation. Avoid using the special broadcast address (0xFFFFFFFF) in packet transmissions until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-138

CWE-159

Related Identifiers

CVE-2024-51500

GHSA-XFMQ-5J3J-VGV8

Affected Products

Meshtastic

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51500.json · Exploit
• https://github.com/meshtastic/firmware/security/advisories/GHSA-xfmq-5j3j-vgv8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-51500 · Security Note
• https://osv.dev/vulnerability/CVE-2024-51500 · Vendor Advisory
• https://t.me/cveNotify/138841 · Telegram Post
• https://twitter.com/CVEnew/status/1853581164893626541 · Twitter Post
• https://t.me/cvedetector/9799 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1853702243188375703 · Twitter Post