Authentication and Authorization Bypass in Meshtastic MQTT Protocol
CVE-2024-47078
9.8CRITICAL
What is CVE-2024-47078?
The Meshtastic firmware, designed for decentralized mesh networking, contains vulnerabilities in its MQTT implementation that allow for both authentication and authorization bypass. Prior to the release of version 2.5.1, these weaknesses made it possible for attackers to gain unauthorized control over MQTT-connected nodes, jeopardizing the security and integrity of the communication within the network. Users are advised to update to version 2.5.1 or later to mitigate these risks and ensure the proper functioning of their device's security protocols.