Security Flaw in Meshtastic Networking Solution Affects User Public Key Management

CVE-2025-55293

What is CVE-2025-55293?

Meshtastic, an open source mesh networking solution, contains a vulnerability that allows an attacker to exploit the public key management system. Specifically, prior to version 2.6.3, an attacker can send a NodeInfo message with an empty publicKey, which subsequently clears the existing key for a known node. This enables the malware to bypass security checks and store a malicious public key in the NodeDB, compromising the integrity and security of the networking device. The issue has been addressed in version 2.6.3, making it crucial for users to upgrade to this version to ensure security.

References