Mesh Networking Solution Vulnerability in Meshtastic Software

CVE-2025-24798

What is CVE-2025-24798?

A vulnerability in Meshtastic firmware versions 1.2.1 through 2.6.2 can be exploited through a crafted packet sent to the routing module, specifically when the 'want_response' flag is set to true. This flaw may cause the system to crash, leading to a disruption of service for other nodes within the communication range of the malicious sender. Moreover, if downlink is enabled via MQTT, it can further exacerbate the situation, compromising network reliability. Users are encouraged to update to version 2.6.2, which contains the necessary fixes to address this issue.

References