CVE-2025-21608: falha de média gravidade em meshtastic firmware
Forged packets over MQTT can show up in direct messages in Meshtastic firmware
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
Meshtastic is an open source mesh networking solution. In affected firmware versions crafted packets over MQTT are able to appear as a DM in client to a node even though they were not decoded with PKC. This issue has been addressed in version 2.5.19 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
meshtastic · firmwareCVEs relacionadas — meshtastic firmware
No mesmo produto, das mais perigosas para as menos.
CVE-2026-44359CRITICALMeshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI WorkflowEPSS 1.8%CVE-2025-24797CRITICALMeshtastic incorrectly hands malformed packets leads to controlled buffer overflowEPSS 0.9%CVE-2024-45038HIGHDevice crash via malformed MQTT packet when downlink is enabled in Meshtastic device firmwareEPSS 0.6%CVE-2025-52464CRITICALMeshtastic Repeated Public and Private KeypairsEPSS 0.6%CVE-2026-42566HIGHMeshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failureEPSS 0.5%CVE-2025-55293CRITICALMeshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDBEPSS 0.5%