Open Source Mesh Networking Solution Vulnerability in Meshtastic

CVE-2025-52464

What is CVE-2025-52464?

The vulnerability in Meshtastic affects versions from 2.5.0 to before 2.6.11, where the flashing procedure by various hardware vendors resulted in the duplication of public/private keys. Moreover, the improper initialization of the internal randomness pool on certain platforms led to low-entropy key generation. As a consequence, attackers capable of compiling lists of compromised keys could intercept and decrypt Direct Messages sent by users with affected key pairs. The issue has been addressed in version 2.6.11 by postponing key generation until the LoRa region is set and alerting users of any detected compromised keys. Version 2.6.12 further enhances security by automatically wiping known compromised keys. Users can also mitigate this vulnerability by performing a complete device wipe to eliminate any vendor-cloned keys.

References