CVE-2024-51500: fallo de gravedad media en meshtastic firmware
Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmware
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.4%
Meshtastic firmware is a device firmware for the Meshtastic project. The Meshtastic firmware does not check for packets claiming to be from the special broadcast address (0xFFFFFFFF) which could result in unexpected behavior and potential for DDoS attacks on the network. A malicious actor could craft a packet to be from that address which would result in an amplification of this one message into every node on the network sending multiple messages. Such an attack could result in degraded network performance for all users as the available bandwidth is consumed. This issue has been addressed in release version 2.5.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Productos afectados
meshtastic · firmwareCVEs relacionadas — meshtastic firmware
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-44359CRITICALMeshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI WorkflowEPSS 1.8%CVE-2025-24797CRITICALMeshtastic incorrectly hands malformed packets leads to controlled buffer overflowEPSS 0.9%CVE-2024-45038HIGHDevice crash via malformed MQTT packet when downlink is enabled in Meshtastic device firmwareEPSS 0.6%CVE-2025-52464CRITICALMeshtastic Repeated Public and Private KeypairsEPSS 0.6%CVE-2026-42566HIGHMeshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failureEPSS 0.5%CVE-2025-55293CRITICALMeshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDBEPSS 0.5%