Vulnerabilities

TI-2026-30846 CVE-2026-42566

Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failure

LOW 39

Meshtastic is an open source mesh networking solution.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00488 Published 2026-07-19 Fixed in 2.7.23.b246bcd CWE-20

TI-2026-32320 CVE-2026-44359

Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow

MEDIUM 52

Meshtastic is an open source mesh networking solution.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01799 Published 2026-07-19 Fixed in 2.7.21.1370b23 CWE-829

TI-2025-34948 CVE-2025-55292

In Meshtastic, an attacker can spoof licensed amateur flag for a node

HIGH 75

Meshtastic is an open source mesh networking solution.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00144 Published 2026-01-27 No fix listed CWE-348

TI-2025-33554 CVE-2025-53627

Meshtastic firmware allows forged DMs with no PKC to show up as encrypted

MEDIUM 57

Meshtastic is an open source mesh networking solution.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.002 Published 2025-12-29 Fixed in 2.7.15 CWE-1287

TI-2025-34949 CVE-2025-55293

Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDB

HIGH 81

Meshtastic is an open source mesh networking solution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00456 Published 2025-08-18 Fixed in 2.6.3 CWE-287

TI-2024-31447 CVE-2024-47065

Traceroute_APP responses are not rate-limited.

MEDIUM 53

Meshtastic is an open source mesh networking solution.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.00284 Published 2025-07-11 Fixed in 2.5.1 CWE-799

TI-2025-33563 CVE-2025-53637

Meshtastic allows Command Injection in GitHub Action

HIGH 68

Meshtastic is an open source mesh networking solution.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00389 Published 2025-07-10 Fixed in 2.6.6 CWE-78

TI-2025-18515 CVE-2025-24798

Meshtastic crashes via an unimplemented routing module reply

MEDIUM 62

Meshtastic is an open source mesh networking solution.

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00444 Published 2025-07-10 Fixed in 2.6.2 CWE-617

TI-2025-32919 CVE-2025-52883

Meshtastic-Android vulnerable to forged DMs with no PKC showing up as encrypted

MEDIUM 57

Meshtastic-Android is an Android application for the mesh radio software Meshtastic.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00264 Published 2025-06-24 Fixed in 2.5.21 CWE-1287

TI-2025-32592 CVE-2025-52464

Meshtastic Repeated Public and Private Keypairs

MEDIUM 42

Meshtastic is an open source mesh networking solution.

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.00595 Published 2025-06-19 No fix listed CWE-331

TI-2025-18514 CVE-2025-24797

Meshtastic incorrectly hands malformed packets leads to controlled buffer overflow

MEDIUM 51

Meshtastic is an open source mesh networking solution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00899 Published 2025-04-14 Fixed in 2.6.2 CWE-119

TI-2025-15568 CVE-2025-21608

Forged packets over MQTT can show up in direct messages in Meshtastic firmware

LOW 30

Meshtastic is an open source mesh networking solution.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00372 Published 2025-02-18 No fix listed CWE-668

TI-2024-34421 CVE-2024-51500

Failure to check for packets from the broadcast address allows potential DDoS…

HIGH 72

Meshtastic firmware is a device firmware for the Meshtastic project.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00418 Published 2024-11-04 Fixed in 2.5.6 CWE-138

TI-2024-31461 CVE-2024-47079

Unauthorized usage of remote hardware module because of missing channel verification

LOW 28

Meshtastic is an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices.

CVSS 3.1MEDIUM 6.4 Adjacent network No auth No interaction EPSS 0.00194 Published 2024-10-07 Fixed in 2.5.1 CWE-345

TI-2024-31460 CVE-2024-47078

Meshtastic firmware Authentication/Authorization Bypass via MQTT

MEDIUM 43

Meshtastic is an open source, off-grid, decentralized, mesh network.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00464 Published 2024-09-25 Fixed in 2.5.1 CWE-287

TI-2024-30150 CVE-2024-45038

Device crash via malformed MQTT packet when downlink is enabled in Meshtastic device firmware

MEDIUM 40

Meshtastic device firmware is a firmware for meshtastic devices to run an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00596 Published 2024-08-27 Fixed in 2.4.1 CWE-755

Vulnerabilities

Filters