PT-2026-5035 · Unknown · Meshtastic

Published 2026-01-27 · Updated 2026-03-02 · CVE-2025-55292

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Meshtastic versions prior to 2.7.6.834c3c5

Description Meshtastic is a mesh networking solution where nodes are identified by their NodeID, derived from the MAC address, rather than their public key. This design flaw allows an attacker to forge NodeInfo on behalf of a victim node, specifically exploiting the HAM mode which lacks encryption. By advertising that HAM mode is enabled, an attacker can overwrite the NodeDB on other nodes in the mesh. This forces those nodes to use a shared channel key instead of the PKC for direct messages to the victim. Furthermore, the attacker can modify Node details such as the full name and short code, as HAM mode does not provide confidentiality or authentication. Maintaining the attack requires regularly resending the forged NodeInfo, particularly after the victim transmits their own information.

Recommendations Update to version 2.7.6.834c3c5 or later.

Exploit

Fix

Weakness Enumeration

CWE-348

Related Identifiers

CVE-2025-55292

GHSA-45VG-3F35-7CH2

Affected Products

Meshtastic

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55292.json · Exploit
• https://github.com/meshtastic/firmware/commit/e5e8683cdba133e726033101586c3235a8678893 · Patch
• https://github.com/meshtastic/firmware/security/advisories/GHSA-45vg-3f35-7ch2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55292 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55292 · Security Note
• https://t.me/cveNotify/150055 · Telegram Post
• https://t.me/cveNotify/153833 · Telegram Post
• https://twitter.com/cracbot/status/2018278264561897566 · Twitter Post
• https://twitter.com/CVEnew/status/2016296315102364092 · Twitter Post