CVE-2025-24798

Published: Jul 10, 2025Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Meshtastic is an open source mesh networking solution. From 1.2.1 until 2.6.2, a packet sent to the routing module that contains want_response==true causes a crash. This can lead to a degradation of service for nodes within range of a malicious sender, or via MQTT if downlink is enabled. This vulnerability is fixed in 2.6.2.

Affected (1)

Products: Meshtastic: Meshtastic Firmware

1 product

Meshtastic Firmware

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Meshtastic Meshtastic Firmware	From 1.2.1 to 2.6.2

Related CWEs

Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References (3)

https://github.com/meshtastic/firmware/blob/cdcbf4c61550e45c125e17a20aff4275e9389655/src/modules/RoutingModule.cpp#L44-L48

Source: security-advisories@github.com

Product

https://github.com/meshtastic/firmware/commit/dc100e4d3e3dfbf58d3ead8141a49cddb0cbdc19

Source: security-advisories@github.com

Patch

https://github.com/meshtastic/firmware/security/advisories/GHSA-4q84-546j-3mf5

Source: security-advisories@github.com

ExploitThird Party Advisory

Timeline

No history available yet.