Authentication Bypass Vulnerability in Meshtastic Networking Solution by Meshtastic

CVE-2025-55292

What is CVE-2025-55292?

The Meshtastic networking solution presents an authentication bypass vulnerability due to its architecture, where a Node is identified by a NodeID derived from the MAC address instead of its public key. This weakness allows an attacker to exploit the HAM mode, which lacks encryption, and forge NodeInfo for a victim node. By doing so, the attacker can manipulate NodeDB data and change node details, enabling ongoing attacks by repeatedly sending forged information. The issue compromises the confidentiality and authenticity of messaging within the mesh network. A solution is available in the latest firmware update.

References