PT-2025-29265 · Unknown · Meshtastic

Published 2025-07-11 · Updated 2025-07-11 · CVE-2024-47065

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Meshtastic versions prior to 2.5.1

Description: Meshtastic, an open source mesh networking solution, does not rate limit traceroute responses from remote nodes in versions prior to 2.5.1. This allows an attacker to reliably and continuously obtain responses, potentially collecting approximately 100 samples within a short timeframe (estimated 2 minutes), compared to the longer duration required for passive collection. This issue also enables a 2:1 reflected Denial-of-Service (DoS) attack on the network, though positional confidentiality is the primary concern.

Recommendations: Update to version 2.5.1 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-799

Related Identifiers

CVE-2024-47065

GHSA-4HJX-54GF-2JH7

Affected Products

Meshtastic

References · 8

• 🔥 https://github.com/meshtastic/firmware/security/advisories/GHSA-4hjx-54gf-2jh7 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47065.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-47065 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47065 · Vendor Advisory
• https://t.me/cvenotify/128616 · Telegram Post
• https://twitter.com/CVEnew/status/1943726101659877846 · Twitter Post
• https://t.me/cvetracker/27581 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1943773778703429870 · Twitter Post