Read the docs
TI-2025-33554 Aliases CVE-2025-53627

Meshtastic firmware allows forged DMs with no PKC to show up as encrypted

Priority MEDIUM 57CWE-1287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Meshtastic is an open source mesh networking solution. The Meshtastic firmware (starting from version 2.5) introduces asymmetric encryption (PKI) for direct messages, but when the `pki_encrypted` flag is missing, the firmware silently falls back to legacy AES-256-CTR channel encryption. This was an intentional decision to maintain backwards compatibility. However, the end-user applications, like Web app, iOS/Android app, and applications built on top of Meshtastic using the SDK, did not have a way to differentiate between end-to-end encrypted DMs and the legacy DMs. This creates a downgrade attack path where adversaries who know a shared channel key can craft and inject spoofed direct messages that are displayed as if they were PKC encrypted. Users are not given any feedback of whether a direct message was decrypted with PKI or with legacy symmetric encryption, undermining the expected security guarantees of the PKI rollout. Version 2.7.15 fixes this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.002 9th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed firmware (meshtastic): 2.7.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
meshtasticfirmware2.5 to before 2.7.152.7.15Patch availableCNA
  • firmware Vendormeshtastic Affected 2.5 to before 2.7.15 Fixed in 2.7.15 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:meshtastic:meshtastic_firmware:*:*:*:*:*:*:*:*2.5.0 to before 2.7.15Vulnerablemeshtastic
  • cpe:2.3:o:meshtastic:meshtastic_firmware:*:*:*:*:*:*:*:* Versions 2.5.0 to before 2.7.15 Vulnerable ·meshtastic

Remediation

  • Fix · CNA firmware (meshtastic) Fixed in 2.7.15

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-53627

References

Exploit 1

  • TI-2025-34949 Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDB CVSS 3.1CRITICAL 9.8
  • TI-2025-34948 In Meshtastic, an attacker can spoof licensed amateur flag for a node CVSS 3.1HIGH 8.2
  • TI-2024-34421 Failure to check for packets from the broadcast address allows potential DDoS… CVSS 3.1HIGH 7.5
  • TI-2025-33563 Meshtastic allows Command Injection in GitHub Action CVSS 3.1HIGH 8.0
  • TI-2025-18515 Meshtastic crashes via an unimplemented routing module reply CVSS 3.1MEDIUM 6.5
  • TI-2024-31447 Traceroute_APP responses are not rate-limited. CVSS 4.0LOW 2.7
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences